Opt-in, opt-out and GDPR: what your consent data is really telling you

Every time a visitor lands on your site and faces the cookie banner, something happens that goes beyond simple compliance. That single click (accept, reject, or ignore) is a data point. And like any marketing data, it can be ignored, or it can tell you something useful about your audience, your site, and the quality of your user experience.

The problem is that most companies treat the cookie banner as a legal hurdle to clear, not as a source of insight. The result: consent data gets collected, because it is mandatory, but almost never analyzed.

Why GDPR is not just paperwork

GDPR requires companies to ask for explicit consent before collecting personal data through cookies and similar technologies. But there is a practical consequence that often gets overlooked: how you ask for that consent, the banner design, the copy, the available options, directly influences how many users accept and how many decline.

This means your Consent Rate (the percentage of users who accept out of everyone who interacts with the banner) is not just a compliance number. It is an indicator of:

• Trust: a low consent rate can signal that users do not trust the site, or do not understand why consent is being requested
• Design quality: intrusive banners, unclear copy, or hidden reject options generate frustration and abandonment
• Brand consistency: if the banner feels out of place compared to the rest of the site, it generates distrust

In other words, monitoring consent is not only about demonstrating compliance during an audit: it is about understanding how users perceive your site in the first few seconds of a visit.

The gap between opt-in and opt-out: what it actually means

If you look at a site's consent data over time, you will almost always notice a certain gap between opt-in (acceptances) and opt-out (rejections), and this gap is not constant: it shifts, sometimes slightly, sometimes sharply. Understanding why is the most interesting part of the analysis.

Some factors that influence this gap:

1. Seasonality and day of the week It is not unusual to see a lower consent rate on weekends or Mondays compared to the middle of the working week. One possible explanation: the type of user browsing on a Saturday, more likely on mobile, in a "distracted scrolling" mode, interacts differently with a banner compared to someone arriving during work hours with a more specific intent.

2. Traffic source A user arriving from a specific organic search, already interested in the content, tends to behave differently than someone arriving from a generic ads campaign. The level of intent changes the likelihood of accepting.

3. Volume and rate are two different things A spike in the absolute number of opt-ins does not necessarily mean the consent rate has improved. There may simply have been more overall traffic that day, for example a newsletter send or a mention on another site. This is why it matters to look at both daily volume (total interactions with the banner) and the rate (what percentage accepts), separately. Mixing the two leads to wrong conclusions: "consents went up" might simply mean "more traffic arrived," not that users trust you more.

4. Changes to the banner itself A change in copy, button placement, or the addition of a new consent category, for example separating Marketing from Statistics, can visibly shift user behavior from one day to the next. Without ongoing monitoring, it is easy to miss the effect of these changes, whether positive or negative.

5. The visitor's country

If your traffic comes from multiple countries, geography alone can explain a meaningful part of the gap between opt-in and opt-out, regardless of how well designed your banner is.

According to Didomi's 2026 benchmark, based on data collected in 2025 across European websites, the average Consent Rate (defined as opt-ins divided by the sum of opt-ins and opt-outs, excluding users who make no choice) ranges from 75.1% to 89.3% depending on the European region. Western Europe records the lowest value, 75.1%, influenced in particular by France, which sits at 71%. Eastern Europe, by contrast, reaches 89.3%.

The same report also tracks a second, distinct metric, the Opt-in Rate (the share of opt-ins out of all banners displayed, which includes cases where the user makes no choice at all): here Western Europe sits at 55.7%, Eastern Europe at 67.6%. The difference between the two metrics is not a technical footnote: Consent Rate measures how likely someone who makes a choice is to accept, while Opt-in Rate measures how much of total traffic ends up generating a valid consent. For anyone analyzing their own Cookiebot data, using one metric or the other as a reference leads to different conclusions, so the choice should be made deliberately and stated clearly when comparing numbers across different sources.

For anyone running sites with international traffic, this has a very practical implication: the aggregate consent rate is a number that hides reality rather than describing it. If traffic comes from countries with different regulations and habits, an average consent rate of 60% can tell very different stories depending on the geographic mix of that traffic. Segmenting the data by country, which the Cookiebot connector in Magic Reports allows by linking it to GA4's source and country data in the same spreadsheet, is a concrete way to understand what is actually happening.

The blind spot GA4 does not show you

There is an even subtler aspect, and probably the most concrete reason why it is worth looking at consent data separately from GA4, not just side by side with it.

Since March 2024, Google requires the implementation of Consent Mode v2 for anyone using Google Ads and Google Analytics personalization, remarketing, and measurement features for users based in the European Economic Area (EEA) and the United Kingdom. When active, GA4 no longer simply stops when a user rejects cookies: it uses behavioral modeling to estimate the behavior of those who declined, based on patterns observed among those who accepted, filling the data gap with estimated numbers.

The problem is that these modeled numbers and the real numbers end up blended in the same report, with no visible distinction. From inside GA4, a session is a session: you cannot tell whether it is a real user who accepted consent, or a statistical estimate filling the gap left by someone who declined.

This creates a counterintuitive but very concrete scenario: if you improve your cookie banner, making it clearer, fairer, reducing friction, and more users genuinely start accepting, the total number of users and sessions in GA4 can stay practically identical. The modeling simply "fills in" fewer estimated data points and more real ones, but the aggregate total does not move visibly. From GA4's point of view, it looks as if the change had no effect at all.

Where does the real change show up instead? In Cookiebot's data: opt-in grows, opt-out shrinks. Total banner interaction volume might stay the same, but its composition shifts, and that is the information that actually matters, because it tells you that you are collecting more real, non-modeled data, even when GA4 alone does not show it.

The chart below illustrates the scenario: on the left, total sessions seen by GA4 stay stable over time (the sum of real plus modeled sessions does not change), while on the right, over the same period, the opt-in and opt-out composition recorded by Cookiebot progressively flips in favor of opt-in. That is the signal that the banner is working better, even though GA4 alone would not have shown it.

Bringing the pieces together, without jumping between dashboards

At this point the problem is clear: understanding what is really happening with your consents takes more than an aggregate number, it requires cross-referencing traffic, country, source, and time period. The issue is that this data often lives in different places, Cookiebot (or your Consent Management Platform) on one side, GA4 and your other marketing tools on the other, and constantly jumping between separate dashboards is the fastest way to stop looking at it regularly.

That is why, at Magic Reports, we built a Cookiebot Consent Data connector that brings this data directly into Google Sheets, side by side with GA4, Google Ads, Meta Ads, and the other channels you already monitor. No manual exports, no pasting CSVs, no keeping a browser tab permanently open on another platform.

Once connected, the connector imports daily metrics such as opt-in, opt-out, and the breakdown by consent category (Preferences, Statistics, Marketing): the same data you need to build a serious analysis, not just a surface-level number.

A ready-made template, if you would rather not start from scratch

For anyone who prefers not to build everything manually, a dashboard template is also available, designed to turn this raw data into a picture you can read at a glance:

• Period KPIs: total sessions, opt-in, opt-out, consent rate, date range analyzed
• Automatic highlights: the day with the most opt-ins, the day with the highest consent rate, daily averages
• Trend over time: a line chart showing opt-in and opt-out day by day, useful for spotting anomalous spikes or drops worth investigating
• Daily volume: a bar chart to distinguish high-traffic days from high-acceptance-rate days, two different things, as we have seen
• Weekday breakdown: a view that cross-references average consent rate and average volume by day of the week, to spot recurring patterns, for example weaker weekends, worth acting on

The advantage of having this data inside the same spreadsheet as the rest of your marketing reporting is that it becomes natural to cross-reference it with other metrics: did the consent rate change in the same period a new campaign launched? Does paid traffic show a different consent pattern than organic? These are questions that stay unanswered if consent data lives isolated somewhere else.

The real value: from compliance to understanding

The core point is this: consent data is not just a regulatory obligation to file away. It is a signal, often overlooked, of how users experience the first contact with your site. A sudden drop in consent rate can precede, or accompany, other problems: declining trust, a shift in the type of traffic arriving, a broader user experience issue.

Treating this data with the same attention you give to conversions or organic traffic is not just good GDPR practice: it is good marketing sense. And if the data already lives in the same spreadsheet where you run all your other analysis, the barrier to looking at it regularly drops dramatically.

---

Want to try the Cookiebot Consent Data connector and the dashboard template described in this article? [Discover Magic Reports] and start the connector's 14-day free trial.

---

Sources

• Didomi, Average consent rate in Europe (2026 data privacy benchmark), data collected in 2025: https://www.didomi.io/blog/benchmark-average-consent-rate-europe
• Didomi, CMP metrics glossary: definitions of Consent Rate and Opt-in Rate: https://www.didomi.io/blog/cmp-consent-banner-performance-metric-glossary
• Google, Updates to consent mode for traffic in European Economic Area (EEA), Tag Manager Help: https://support.google.com/tagmanager/answer/13695607