GDPR consent and
tracking, done right

Most consent and tracking projects sit between €3.000 and €15.000 for the build, depending on the site’s complexity, the number of third-party scripts in play, and whether Consent Mode v2 needs configuring alongside the cookie consent management platform. A basic setup on WordPress with a standard CMP (Cookiebot, OneTrust, Iubenda, CookieYes, Termly) and 5 to 10 tag categories runs €3.000 to €6.000. A complex setup with ATS embeds, chat tools, multiple ad platforms, server-side tagging, and Consent Mode v2 lands between €8.000 and €15.000. Custom CMS or headless setups can run higher. Hourly rates run €60 to €65 across all roles. Most projects complete within 2 to 4 weeks from kickoff to live. Our pricing page covers the broader rate structure.

Depends on your scale, your existing stack, and your appetite for free versus paid tools. Free or low-cost CMPs that work well for small to medium sites: Cookiebot (€10 to €100/month depending on site size, good NL/EU compliance), CookieYes (free tier plus paid plans from €10/month, simpler UI), Termly (free tier plus paid plans from $10/month, US-focused but works for EU). Enterprise CMPs for complex needs: OneTrust (the market standard, expensive but feature-complete), Iubenda (Italian-built, strong EU focus, mid-market pricing), Didomi (French-built, popular with French and German enterprises), Usercentrics (German-built, strong on GDPR plus ePrivacy). For pure WordPress sites with simple needs, Complianz is a popular WP plugin alternative. Studio Ubique works with all of the above and can recommend based on your specific situation. The “best” CMP depends on whether you need automatic cookie scanning, multilingual banners, granular category control, or integration with specific tag managers.

ATS embed scripts are one of the most common consent compliance failures on careers sites. The scripts often inject cookies and fire analytics events as soon as the page renders, regardless of what the consent banner says. Three common patterns to fix this. First, delay loading: wrap the ATS embed in a consent-gated container that only loads the iframe or script when the user accepts marketing consent. Second, switch to consent-aware integrations: most modern ATS platforms (Greenhouse, Lever, Teamtailor, Recruitee, Workable) offer consent-aware embed options or have documented patterns for compliant integration. Third, sandbox or replace: for ATS platforms without consent-aware options, use a referrer-only redirect to the ATS application form (no embed, no pre-consent tracking) or replace the embed with a server-rendered application form that submits to the ATS API. The right pattern depends on which ATS, what data needs to flow, and how critical inline application flow is for conversion. Our ATS integrations page covers the broader integration patterns.

Google Consent Mode v2 is a framework that lets Google tags (Google Analytics 4, Google Ads, Google Tag Manager) adjust their behaviour based on user consent signals from your cookie banner. When users decline consent, tags don’t fire normally, instead they send anonymous “consent-denied” pings that let Google measure reach without storing personal data. You need Consent Mode v2 if: you run Google Ads campaigns targeting EU users (mandatory since March 2024 for full ad personalisation and conversion attribution), you use Google Analytics 4 in the EU and want partial measurement when users decline (otherwise GA4 simply doesn’t track declined users), or you want Enhanced Conversions, audience targeting, or modelled conversions in Google Ads. You don’t strictly need it if: your audience is fully outside the EU, EEA, UK, and Switzerland, or you’re comfortable with significantly reduced measurement when users decline. For most EU-focused businesses, Consent Mode v2 is now standard rather than optional.

Audit-ready consent records need four data points per user interaction: who consented (a pseudonymous identifier like a hashed user ID or session ID, not name or email unless they were logged in), when consent was given or changed (timestamp), what they consented to (which categories they accepted or rejected), and how they were asked (which banner version they saw, what the wording was, what options were presented). Most modern CMPs (Cookiebot, OneTrust, Iubenda, Didomi, Usercentrics) record these automatically and provide export functionality. The key checks: retention periods that match your privacy policy (typically 2 to 5 years depending on jurisdiction and policy), exports in a format your legal team can actually use (CSV or structured PDF, not just a screenshot tool), the ability to retrieve specific user records on request for data subject access requests (DSARs), and audit logs for banner version changes (so you can prove what wording was shown in any given month). Studio Ubique sets up retention, export, and monitoring as part of standard consent and tracking work.

Multi-language sites: the consent banner needs to display in the user’s language, either by detecting browser language, following the site’s language switcher, or showing the language matching the URL path (typical for sites with /en/, /nl/, /de/, /fr/ prefixes). All major CMPs support multi-language banners with translation files you maintain. For non-EU visitors, three approaches. First, the strict approach: show the GDPR consent banner to everyone regardless of location (simpler to implement, treats all users equally, sometimes preferred by US clients who want privacy as a brand position). Second, geo-targeted: detect user location via IP and show different consent flows (full GDPR banner for EU, simpler “Accept cookies” notice for US, location-specific compliance for California CCPA, Quebec Law 25, Brazil LGPD, etc.). Third, jurisdiction-aware CMPs: enterprise CMPs (OneTrust, Cookiebot, Didomi) detect user location automatically and serve the right banner version, which simplifies maintenance for sites serving multiple markets. The right approach depends on your audience geography and operational complexity tolerance. Our case studies show projects across different multi-jurisdiction setups.

Both. About 60% of consent and tracking projects are fixes to existing setups, the other 40% are new builds. Common fix scenarios: CMP is installed but tags still fire pre-consent (the “decline button does nothing” problem), Consent Mode v2 was added but configured incorrectly (you see it in the GTM debugger but consent signals aren’t reaching tags), consent logs exist but can’t be exported in a useful format, banner categories don’t match what tags are actually doing (the “everything is functional” problem), or a recent site change broke previously-working consent flow. Fix projects typically run 5 to 15 working days depending on stack complexity and start with an audit pass to map what’s actually firing. Output of the audit: a documented gap list, a recommended fix order based on legal exposure plus implementation effort, and a fixed budget for the work. If the audit shows that a full rebuild is cheaper than a fix (sometimes the case with very old or heavily-modified setups), we say so directly rather than billing for incremental patches that won’t hold. A first call usually identifies which path fits within 30 minutes.