US privacy law works differently from Europe’s. Most states let you track by default and require you to honor an opt-out, so the hard part is not a cookie banner: it is making sure an opt-out, or a browser’s Global Privacy Control signal, actually stops the pixels that sell or share data, while your analytics keeps counting.
We build that setup on server-side Google Tag Manager, GA4 and the ad platforms’ server APIs (Meta Conversions API, Google Ads enhanced conversions, TikTok Events API), so you keep the conversions that ad blockers and browser limits drop and stay in control of what each vendor receives.
Under the CCPA as amended by the CPRA, sending data to ad platforms for cross-context behavioral advertising counts as “sharing”. A “Do Not Sell or Share” request has to stop it. We map each tag to the consent it needs and test that an opt-out stops Meta, TikTok and Google Ads data while GA4 keeps measuring in a restricted mode.
California, Colorado, Connecticut and a growing list of states require businesses to treat a universal opt-out signal such as GPC as a valid opt-out. We read the signal in the data layer and apply it before any marketing tag fires, and record that it was honored.
Google Consent Mode v2 can default to granted for US visitors and denied for visitors from the EU, UK and Switzerland, using the region setting. One container then serves both, instead of applying the strictest rule to everyone or ignoring it for everyone.
A wave of US claims under wiretapping laws such as California’s CIPA, and under the Video Privacy Protection Act, targets session recording, chat and pixels that run without notice or consent. We list every tool that records or shares visitor behavior and gate it properly. This is engineering, not legal advice: your counsel sets the policy, we make the tags follow it.
Washington’s My Health My Data Act and similar state rules require consent before collecting consumer health data. For wellness, supplement and health brands we keep product and condition details out of ad-platform events unless that consent is given.
US sales tax, shipping, discounts and refunds are the usual reasons GA4 revenue disagrees with Shopify. We define one revenue figure, send it the same way to GA4 and every ad platform, and reconcile orders to events transaction by transaction.
What we most often find in a US setup, and what it looks like once it is fixed.
Drag to compare. Illustrative example of a typical account, not a specific client.
A “Do Not Sell or Share” opt-out does not stop the Meta, TikTok or Google Ads tags
Each tag mapped to the consent it needs, and an opt-out tested to stop ad-platform data while GA4 keeps measuring
Browsers sending Global Privacy Control are treated like every other visitor
GPC read in the data layer and applied before any marketing tag fires, with a record that it was honored
One consent setting for every region: too strict for US traffic, or too loose for EU visitors
Consent Mode v2 defaults set by region, so one container serves US and EU/UK visitors correctly
GA4 revenue disagrees with Shopify because of sales tax, shipping and refunds
One revenue definition sent the same way to GA4 and every ad platform, reconciled order by order
We read your container, GA4 property and live site, and list what is broken, duplicated, missing or firing without the right consent.
A tracking plan: every event, its parameters, which vendors get it and which consent each needs. You approve it before anything changes.
Server-side container, data layer, server APIs and consent rules, in a staging workspace first.
We test opt-outs, GPC and revenue against real orders, then hand over documentation and a QA dashboard.
Not in the same way. The CCPA is mainly an opt-out law: you must tell visitors what you collect, offer a “Do Not Sell or Share My Personal Information” choice, and honor GPC. Some data, such as sensitive or health data in certain states, needs opt-in consent. Your counsel decides the policy; the tracking then has to enforce it.
It reduces what ad platforms receive for the visitors who opt out, which is the point. Server-side tracking and enhanced conversions recover much of what browsers and ad blockers lose for everyone else, so the net effect is usually better measurement, not worse.
No. A server-side container follows the same consent rules as the browser one. Its benefit is reliability and control over what each vendor receives, not avoiding opt-outs.
Yes, including Shopify’s Customer Events and checkout extensibility, WooCommerce, BigCommerce and custom or headless storefronts.
Work is planned in a shared tracking plan and handled asynchronously in your Slack or Teams, with calls scheduled to overlap with your working day. Changes go to a staging workspace first, so nothing reaches your live site without review.
Tell us about your store and stack. We review it and send back a prioritized list of what to fix first.
Start With an Audit