GDPR Compliant Tracking: What You Can Measure Legally
GDPR compliant tracking is often described as a tooling decision — swap one script for another and you're…

Conversion funnel tracking has a reputation for being complicated, and most of that reputation is earned by tools rather than by the idea. The concept is simple: pick the handful of steps someone takes on the way to a goal, count how many people reach each one, and look at where they stop. You don’t need a tag manager, a data layer, or a consent banner to do that well.
I’ve built funnels in heavyweight platforms and in tools that fit on one settings screen. The lightweight ones answered my actual questions faster. Below is how I set up conversion funnel tracking now — what to define first, which method to use for each step, and how to do it without storing anything on a visitor’s device.
The most common mistake happens before any tracking code is touched. People open their analytics tool, look at the available events, and assemble a funnel out of whatever happens to be there. The result measures the tool’s defaults instead of the business.
So start on paper. Write the steps a real person takes, in order, in their own terms:
Three to five steps is the sweet spot. Two isn’t a funnel — it’s a conversion rate. Beyond five or six, every step carries so little traffic that normal weekly variation looks like a trend, and you’ll chase noise for months.
Each step also needs to be genuinely sequential. If visitors routinely hit your pricing page before the service page, those two aren’t a funnel — they’re just two popular pages. Consequently, the drop-off numbers you calculate would be meaningless. Check the actual order in your page reports before committing to it.

Every step is measured in one of three ways. Choosing correctly per step is most of the work.
| Method | Best for | Setup cost | Watch out for |
|---|---|---|---|
| URL-based | Steps that have their own page | None — works out of the box | Query strings splitting one step into many |
| Event-based | Actions with no page change | A line of code per action | Naming drift over time |
| Hybrid | Most real funnels | Low | Mixing definitions between steps |
URL-based tracking is free in the sense that it requires no new code. If your checkout genuinely moves through /cart, /shipping, /payment, and /thank-you, you already have a four-step funnel and just need to declare it in your tool.
Event-based tracking is for the steps that don’t change the URL: opening a modal, expanding a pricing tier, starting a form, clicking to a payment provider. Modern single-page apps push almost everything into this category, which is why funnels there take longer to set up.
In practice, most funnels are hybrid — two URL steps, one event step, one URL step. That’s fine. The only rule is consistency: don’t measure step 2 by page view and step 3 by a click that also fires on page 2, or your rates will exceed 100% and you’ll spend an evening confused.

Here’s the question I get most: if a tool doesn’t set cookies, how does it know the same person reached step 3 after step 1?
The honest answer is that it doesn’t know it’s the same person. It knows it’s the same visit. Cookieless tools stitch a session together server-side, typically by deriving a rotating identifier from properties of the request — user agent, IP, a daily-rotating salt — that is hashed and discarded rather than stored on the device. Within a day, the tool can tell that a sequence of pageviews belongs to one session. Across days, it deliberately cannot.
That limitation matters less than people expect, for a simple reason: most funnels complete in one sitting. A checkout, a signup, a contact form — these are single-session behaviours. The funnels that genuinely span weeks are B2B sales cycles, and those are tracked in a CRM against a known contact, not in web analytics against an anonymous visitor.
What you give up is multi-session attribution — knowing that the person who converted on Thursday first arrived from a newsletter on Monday. That’s a real trade-off, and it’s worth naming rather than glossing over. What you get back is a funnel that works for every visitor instead of only the 60–80% who accept a banner. I covered the underlying mechanics in more depth in this guide to cookieless tracking.
A funnel measured on all visitors without consent beats a funnel measured on the subset who clicked “Accept” — the second one is biased toward people who click Accept, and there is no way to correct for it after the fact.
Assuming your steps have URLs, the setup takes about ten minutes in most privacy-first tools. The pattern is nearly identical across Plausible, Umami, and self-hosted options.
/pricing?ref=newsletter and one at /pricing must count as the same step. Most tools strip parameters by default — verify yours does, because this single issue quietly halves funnel numbers.Step 2 deserves emphasis. Campaign parameters, session IDs appended by plugins, and trailing slashes are the three usual culprits behind a funnel that shows an impossible collapse between step 1 and step 2.
Add an event when the meaningful action leaves no URL trace. Form starts are the classic case: knowing how many people began typing versus how many submitted separates “nobody finds the form” from “the form is too long.”
Keep the naming boring and consistent. I use object_action in lowercase with underscores — form_start, form_submit, plan_selected. Fifteen inconsistently named events become unusable within a year, and renaming later breaks historical comparisons.
Two habits keep event funnels healthy. First, never fire an event on page load if it’s meant to represent an intentional action — it inflates the step and hides the real drop. Second, don’t attach personal data to event properties. A plan name is fine; an email address turns an anonymous measurement system into a personal data store, with all the obligations that follow. There’s more on event design in this piece on e-commerce event tracking.
Once data arrives, three habits prevent bad conclusions.
Read step-to-step, not just top-to-bottom. An overall rate of 2% tells you nothing actionable. Learning that 60% of people move from pricing to form start, and then only 20% of those submit, points directly at the form.
Check the absolute numbers before reacting to a percentage. A step that went from 40% to 25% sounds alarming until you see it’s 4 people instead of 10. Weekly noise on small samples is enormous, and I’ve watched teams redesign pages over what was statistical dust.
Compare like periods. Traffic mix changes by day of week and by campaign. A funnel measured during a promotion isn’t comparable to a quiet week, because the visitors are different people with different intent.
For the specific metrics worth watching once the funnel is running — and which ones to ignore — I go through them in this breakdown of the five funnel metrics that matter.

Conversion funnel tracking is worth doing on almost any site with a goal, and it’s far less work than the tooling ecosystem suggests. Define three to five real sequential steps, measure each with the simplest method that fits, normalise your URLs, and wait for enough volume before reading anything into the numbers.
You don’t need cross-device identity resolution to learn that four out of five people abandon your form. Cart abandonment averages 70.22% across 50 documented studies, according to Baymard’s ongoing meta-analysis — and that pattern shows up clearly in single-session, cookieless data. The fix is almost always in the page, not in the tracking sophistication.
Start with one funnel for your single most important goal. Get it right, act on what it shows, and only then add a second. Most sites I’ve worked on never needed a third. If you’re still deciding what deserves tracking at all, this guide to what to track and what to ignore is the place to begin.
GDPR compliant tracking is often described as a tooling decision — swap one script for another and you're…
Cookieless tracking sounds almost too good to be true: you measure your website traffic, but you skip the…
Most conversion funnel guides make a simple concept unnecessarily complex. They throw around terms like "TOFU," "MOFU," and…