UTM tracking that waits for cookie consent before it stores anything
By default, until your cookie banner says yes, TraceLead stores nothing, sends no visitor data and fills no field. It follows Cookiebot, OneTrust, CookieYes, Complianz, iubenda, Usercentrics and Google Consent Mode by itself, or your own banner's call, and deletes what it stored when a visitor changes their mind.
No card needed. No lead caps on any plan.
Added by TraceLead's hidden fields. The name and email stay in your form.
- Channel
- Paid search
- Source / medium
- google / cpc
- Campaign
- brand-uk
- Click ID
- gclid
UTM parameters and cookie consent: what happens when
UTM tags and click ids are in the address bar whether or not the visitor accepts cookies. Keeping them until the visitor enquires means storing them in the browser, and that is the step TraceLead holds back until your banner allows it.
-
Before a choice
The landing address is parsed in memory. The snippet loads its site settings, but no cookie, no
localStorage, no visitor data sent to TraceLead, no field filled. - Accepted The first touch is stored in a first-party cookie on your domain, hidden fields are filled, and pseudonymous session and lead records are sent if collection is on for the site.
- Rejected Nothing is stored, no visitor data is sent, and the fields stay empty. The form still submits as normal.
- Withdrawn later The first touch, last touch, visitor id and visit counter are deleted from the browser and filled fields are cleared.
This is the site's default Explicit consent mode. A site can be switched to Assumed, where storage starts at once because you declare a legal basis exists; that declaration is yours to make, and a preset's "rejected" still withdraws.
Cookiebot UTM tracking and other consent manager presets
Pick your consent manager and the snippet reads its state on load and listens for changes. A preset never loads the manager's code; it only reads the one already on your page.
The full consent guide-
Choose your consent manager
On your site's page in TraceLead, open Attribution settings → Consent manager and pick yours:
- Cookiebot: Follows Cookiebot's Marketing category.
- OneTrust: Follows OneTrust's Targeting cookies group (C0004).
- CookieYes: Follows CookieYes's Advertisement category.
- Complianz: Follows Complianz's Marketing category.
- iubenda: Follows iubenda's Marketing purpose (5). Load the TraceLead tag before iubenda's script.
- Usercentrics: Follows Usercentrics' Marketing category (V2 window event "ucEvent", or V3).
- Google Consent Mode: Follows ad_storage from gtag('consent', …), whichever banner sets it.
-
Or call TraceLead from your own banner
Keep My own consent call and call this on every page once the visitor's choice is known:
window.tracelead('consent', true); // storage for attribution permitted window.tracelead('consent', false); // withdrawn: deletes the touch, visitor id and filled fields -
Check the gate
Run
tracelead.diagnostics()in the browser console.consentandcmpshow whether the gate is open and which manager is followed;detected: falsemeans the manager's script was not found and the snippet stays inert. The snapshot holds no values or URLs.
UTM tracking, GDPR and PECR: what TraceLead keeps
Whether and how the GDPR and PECR apply to your site is for you and your adviser to decide. These are the facts to decide with.
TraceLead's privacy policy and cookie policy describe the processing in full.
| Where | What, after consent only |
|---|---|
| tl_ft_<site id> | First-party cookie on your domain (or localStorage): the first touch, for the lifetime you set, 90 days by default. |
| tl_vid_<site id> | A random visitor id for counting sessions and leads, kept beside the first touch. |
| tl_lt_<site id> | The last touch, only when the site keeps one. |
| tl_ec_<site id> | A visit count and the time of the last visit, only when the site counts visits before a lead. |
| TraceLead's servers | Pseudonymous sessions and leads: random ids, page path, form id and the first-touch attribution (channel, source, medium, campaign, referrer host, landing page, click-id type). Never names, emails, form answers, full URLs, IP addresses or user agents. |
No fingerprinting, no third-party cookies, no identity shared across sites. The form always submits, whether or not consent was given and whether or not TraceLead is reachable.
Attribution without personal data. No names, emails, form values, IP addresses or user agents. Ever.
No privacy workarounds. Nothing before consent, no fingerprinting, no ad-blocker bypass, no cross-site identity.
Made in the UK. GBP pricing, UK consent rules in mind, and a person who answers email.
Questions, answered
Anything else? Email us and a person replies.
Does UTM tracking need cookie consent?
That depends on your site, your visitors and the rules where you operate, and is a question for your own legal adviser. What TraceLead does is fixed: in its default Explicit mode it stores nothing, sends no visitor data and fills no field until your consent banner says yes.
What happens to UTM parameters before the visitor accepts cookies?
The landing address is read in memory only. Nothing is written to cookies or localStorage and nothing is sent to TraceLead. If the visitor accepts on that same page, the campaign from the landing is captured then; if they leave without accepting, it is gone.
How do I use Cookiebot with UTM tracking?
Choose Cookiebot as the site's consent manager preset and the snippet follows Cookiebot's Marketing category by itself, with no code on your page. Presets exist for Cookiebot, OneTrust, CookieYes, Complianz, iubenda, Usercentrics and Google Consent Mode.
Which consent category does UTM tracking fall under?
The presets follow the marketing or advertising category (OneTrust C0004, Consent Mode ad_storage), because the record exists to tie a lead to the campaign that brought it. If your policy files it elsewhere, choose My own consent call and signal consent from the category you have chosen.
What happens when a visitor withdraws consent?
The snippet deletes what it stored in that browser, the first touch, the last touch, the visitor id and the visit counter, and clears any hidden fields it filled. Nothing more is sent from that browser until consent is given again.
What does TraceLead store about visitors on its servers?
After consent, pseudonymous sessions and leads with their attribution: a random visitor and session id, the page path, the form id on leads, and the first-touch attribution: channel, source, medium, campaign, referrer host, landing page and which kind of click id was present. Never names, email addresses, form answers, full URLs, IP addresses or user agents.
More features
Attribution that starts when your banner says yes.
Install the tag, choose your consent manager in the site's attribution settings, and check the result in the browser console.
No card needed. Cancel any time.
Site → Attribution settings → Consent manager
Cookiebot · OneTrust · CookieYes · Complianz · iubenda · Usercentrics · Google Consent Mode
Or, from your own banner:
window.tracelead('consent', true);
window.tracelead('consent', false);