Measurement after cookies: a pragmatic stack for mid-sized companies

For years, marketers were told third-party cookies were about to disappear. Then, in 2025, Google decided to keep Chrome's existing approach to third-party cookies rather than introduce a new prompt, and later retired most of its Privacy Sandbox technologies (Google (opens in a new tab), update (opens in a new tab)). Problem solved? Not really. Measurement had already got harder for other reasons, and those haven't gone away.

This guide sets out a pragmatic measurement stack for a mid-sized company, the kind with a marketing team of a few people, several ad platforms, a CRM and no dedicated data science function. It's written with Canadian privacy rules in mind, but the architecture works anywhere.

Why measurement still got harder

• Browsers restrict tracking. Safari and Firefox block third-party cookies by default and limit other tracking techniques. Apple's WebKit team documents its tracking prevention policy publicly (WebKit (opens in a new tab)).
• Apps need permission. On iOS, apps must ask before tracking users across other companies' apps and websites, through App Tracking Transparency (Apple (opens in a new tab)).
• Consent is required, and often declined. Privacy law and platform policies require meaningful consent for many forms of tracking. Every "reject" reduces what tags can see.
• Ad blockers and network-level blocking stop many client-side tags from loading at all.
• Journeys span devices and channels. Research on a phone, purchase on a laptop, a sales call in between. No single tool sees the whole path.

The upshot: any tool that relies on following individuals across sites sees a shrinking, skewed slice of reality. A good stack accepts that and is built from parts that degrade gracefully.

Four design principles

1. Consent first. Collect what you're allowed to, record what you were told, and respect it everywhere downstream.
2. First-party over third-party. Data you collect directly (orders, leads, logins, CRM records) is more complete, more durable and easier to govern.
3. Server-side where it helps. Sending key events from your own server is more reliable than depending only on browser tags.
4. Experiments over assumptions. Attribution describes; incrementality tests measure cause. You need both.

Layer 1: consent and governance

In Canada, the federal private-sector privacy law (PIPEDA) requires meaningful consent, and the Office of the Privacy Commissioner has published specific guidelines on online behavioural advertising (opens in a new tab), including that opt-out should be easy and that tracking which can't be declined (such as some device fingerprinting) shouldn't be used. Quebec's privacy law is stricter: Quebec's regulator says technologies that identify, locate or profile people must be off by default and require an affirmative choice, with refusing as easy as accepting (Commission d'accès à l'information (opens in a new tab)). If you have European visitors, GDPR applies too. Get legal advice for your situation; this is not it.

Practically:

• Use a consent management platform that can apply different rules by region (for example, opt-in for Quebec and the EU).
• Connect it to your tags with Google's consent mode (opens in a new tab), which passes the user's choices to Google tags, and the equivalent controls for other platforms.
• Write down what data you collect, why, where it goes and how long you keep it. Your privacy notice should match reality.

Layer 2: a clean event layer and first-party data

• A tracking plan. One document listing every event (page view, add to cart, lead submitted, purchase), its parameters and where it's sent. Most measurement problems we audit trace back to the absence of one.
• A data layer on the site that exposes those events consistently to your tag manager.
• Analytics (Google Analytics 4 or an alternative) configured with the key events marked as conversions, internal traffic filtered and sensible channel groupings, including one for AI assistants.
• UTM discipline. Consistent campaign tagging rules, enforced. Agents are good at checking this.
• Value exchange for first-party data. Accounts, newsletters, quizzes, loyalty programs: reasons for customers to identify themselves willingly.

Layer 3: server-side and platform conversion APIs

Browser tags are fragile. Adding server-side paths for your most important events makes measurement more complete and resilient:

• Server-side tagging. Google Tag Manager's server-side container (opens in a new tab) moves tag processing to a server you control, so you decide what data each vendor receives.
• Enhanced conversions in Google Ads send hashed first-party data (such as an email address the customer provided) with conversion events to improve matching (Google Ads Help (opens in a new tab)).
• Meta's Conversions API sends events from your server to Meta, alongside or instead of the browser pixel, with deduplication.
• Offline conversion imports. For lead-gen businesses, send qualified leads and closed deals from your CRM back to the ad platforms, so bidding optimizes for revenue instead of form fills.

All of these must respect consent. Server-side does not mean "around the rules"; it means more control over data you're allowed to send.

Layer 4: CRM and revenue attribution

For any business with a sales process or repeat customers, the CRM is the source of truth. Make sure:

• Every lead or customer record captures first-touch and latest-touch source (from UTMs and referrers), stored at the time of capture.
• Opportunities and revenue link back to those sources, so you can report pipeline and revenue by channel.
• Sales and marketing agree on lifecycle stages and definitions.

Simple, consistent rules (first touch for "what brings people in", last touch for "what closes") are more useful than complex multi-touch models fed by incomplete data.

Layer 5: incrementality tests

Attribution, however well implemented, tells you which channels were near a conversion. To learn which channels caused conversions, you need controlled experiments: geo tests, platform lift studies and holdout groups. Geo tests are especially well suited to a privacy-first world because they use aggregated sales by region, with no user-level tracking at all. Our Canadian geo testing guide explains how to run one, and iROAS vs ROAS explains how to use the results to calibrate everyday reporting.

Layer 6: reporting people use

• One scorecard with a small number of agreed metrics: revenue or pipeline, new customers, cost per incremental acquisition, contribution margin, and leading indicators.
• Calibrated channel views that show platform-reported results next to test-adjusted estimates.
• A weekly written summary: what changed, why, and what we're doing about it. An analyst agent can draft it; a person should check it.

What it looks like in practice

Most of these have free tiers or are included with tools you already pay for. The bigger cost is the setup and the discipline to maintain it.

In what order?

1. Consent and a tracking plan (everything else depends on them).
2. Fix analytics and key conversion events; set up the AI assistants channel group.
3. Enhanced conversions and Conversions API for your largest ad platforms.
4. CRM source capture and offline conversion imports (for lead-gen).
5. Your first incrementality test on the largest or most-questioned channel.
6. Scorecard and weekly summaries.

Expect the first three steps to take weeks, not months, for a typical mid-sized site, depending on developer availability.

Common pitfalls

• Treating consent as a banner, not a system. If the choice isn't passed to tags and platforms, the banner is decoration.
• Double-counting events when adding server-side alongside browser tags without deduplication.
• Trusting the sum of platform reports. Add up what every platform claims and it often exceeds actual revenue.
• Complex attribution models on incomplete data. Sophistication doesn't fix missing data.
• No owner. Tracking decays quietly as sites change. Someone, or an agent with a human owner, needs to check it every week.

Frequently asked questions

We set up and maintain measurement stacks like this, and run the tests on top. See analytics and measurement and incrementality testing, or get in touch.