Consent for Analytics on the Thank-You Page: The Purchase Event That Fires Before the Choice

The order is complete. The thank-you page loads, and the purchase event fires: order value, items, currency, all of it, sent to analytics before the shopper has made a consent choice. The banner appears a second later, and the shopper clicks reject, but the data is already gone. The choice came after the data, and the data cannot be recalled.

That is the consent problem on the thank-you page, and it is the one most stores never notice, because the analytics look correct. The purchase event fires, the conversion is recorded, and the dashboard shows the sale. What the dashboard does not show is that the event fired before consent, which means the data was collected without a lawful basis, and the consent record, when it exists, says the shopper rejected analytics after the analytics had already run.

What fires before consent

Consent Mode v2 is the framework for this, and it has two modes: basic and advanced. In basic mode, no Google tags fire until the user consents, which is the compliant default. In advanced mode, the tags fire in a denied state, sending cookieless pings, and upgrade to full data collection when consent is granted. The difference matters, because advanced mode still sends data before consent, and the data it sends is the purchase event, which is the most sensitive event in the funnel.

The CNIL's position is clear. In its 2020 guidelines, the CNIL said that consent must be obtained before any data collection, and that the banner must not use dark patterns to nudge the user toward acceptance. The CNIL's July 2025 self-assessment, which replaced the exempt-tool list, requires sites to demonstrate that their analytics are compliant, and a purchase event that fires before consent is not compliant, regardless of which mode the tag is in.

The fix, in order

First, check what actually fires on the thank-you page before consent. Open the page with a fresh browser, block the consent banner, and look at the network requests. If the purchase event fires, the tag is misconfigured, and the fix is to gate the tag on consent, not on page load. Second, use Consent Mode v2 in basic mode, not advanced, because basic mode does not fire the tag until consent is granted, and advanced mode fires a cookieless ping that still sends data. Third, test the thank-you page after the fix, with a fresh browser, and confirm that no analytics request fires before consent.

The GDPR adds a second requirement, which is proof. Article 7 requires the controller to demonstrate that consent was obtained, and the proof is a record: who consented, when, to what, and how. A consent receipt, stored with a timestamp, is the record, and the timestamp must be accurate, because a clock skew between the server and the client can make the receipt argue with itself. The receipt is the product, and the thank-you page is where it is most often missing.

The receipt is the product

Store the consent receipt with the order, not separately from it, because the order is the event the receipt refers to. The receipt should record the consent state at the time of the purchase, the timestamp, and the version of the banner the shopper saw. If the shopper later withdraws consent, the receipt should record the withdrawal, and the analytics should stop. The consent log is the product, and the thank-you page is where it starts.

The purchase event should fire after consent, not before it. Gate the tag, use basic mode, and store the receipt with the order. The data will be cleaner, and the consent will be real.

Keep reading: Consent mode v2 in practice: what actually fires before consent, Consent receipts: what to store and for how long, Consent Opt-In Rates: What a Good Number Looks Like, and What It Hides.

Frequently asked questions

Does the purchase event fire before consent on most thank-you pages?

Often, yes. The analytics tag fires on page load, and the banner appears a second later. The data is sent before the shopper has made a choice, and it cannot be recalled.

What is the difference between Consent Mode v2 basic and advanced?

In basic mode, no Google tags fire until the user consents. In advanced mode, the tags fire in a denied state, sending cookieless pings, and upgrade when consent is granted. Basic is the compliant default.

What does the CNIL require for analytics consent?

Consent must be obtained before any data collection, the banner must not use dark patterns, and the site must demonstrate compliance. The CNIL's July 2025 self-assessment replaced the exempt-tool list.

What should a consent receipt record?

Who consented, when, to what, and how, with an accurate timestamp. Store the receipt with the order, and record any later withdrawal.