Ad Attribution by Country in 2026

If you run an e-commerce store and advertise internationally, here is a reality you need to face: ad attribution by country varies enormously. The same Google Ads campaign will give you completely different attribution accuracy depending on where your customer is located.

A US customer clicks your ad and buys three days later? You will almost certainly know which ad drove the sale. A German customer does the exact same thing? By our estimate it is close to a coin flip whether that conversion stays visible in your reporting.

This is not a technical limitation. It is a legal one. Each market's cookie consent law, its opt-in or opt-out model, and how strictly the local data protection authority enforces it determine how much tracking data you keep. And the gap between countries is far larger than most store owners realize.

I spent time researching the actual cookie consent laws, enforcement actions, and realistic consent rates for every major market. This article gives you the full picture so you can make informed decisions about your ad spend, your tracking setup, and your expectations for each country.

Ad Attribution by Country: The Complete Comparison Table

The comparison table below covers every major e-commerce market. It shows the consent model (whether users must opt in or opt out), how aggressively the law is enforced, and what percentage of ad-driven orders you can realistically attribute with Click ID tracking.

How to read the "realistic attribution" column: this is our estimate, not measured data. It is the share of ad-click conversions we would expect to carry a Click ID (GCLID, FBCLID) on the order, after consent rates, ad blockers and technical losses. No regulator publishes consent rates, so treat every figure in that column as a planning range, and higher is better.

Key insight: if you sell to US customers, you can expect to track nearly every ad-driven conversion, while for French or German customers you should plan on losing more than half of your attribution data to consent requirements. These are enforceable laws with real fines, not optional guidelines. This data loss affects every attribution model, whether you use first-touch, last-touch, or multi-touch attribution.

Why the US Opt-Out Model Keeps Attribution Near 100%

If your customer base is primarily in the United States, you are in the best position globally for ad attribution.

The US has no federal cookie consent law. There is no opt-in requirement. No consent banner is legally required for ad tracking cookies. The only obligation is:

• Disclose your tracking practices in your privacy policy
• Provide an opt-out mechanism for California (CCPA/CPRA "Do Not Sell" link) and a handful of other states (Colorado, Connecticut, Oregon) that require honoring Global Privacy Control signals
• Honor "Do Not Sell or Share" requests when they come in

The practical opt-out rate in the US is 1-5%. The vast majority of Americans either do not see a consent banner (because many US sites do not show one) or click through it without changing settings.

What this means for Enalitica users: with server-side Click ID tracking, we estimate that 95-98% of ad-driven orders from US traffic can carry their click ID into Enalitica. That is near-complete visibility into which campaigns, ad groups, and keywords are driving real revenue.

The same applies to Australia (no cookie law yet, reforms pending for 2026-2027) and Canada outside Quebec (opt-out model under PIPEDA).

19 US State Privacy Laws (and Counting)

As of January 2026, 19 US states have comprehensive privacy laws in effect: California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

All of them use an opt-out model, not opt-in. You must let users opt out of targeted advertising and the sale or sharing of their data, but you do not need prior consent to set tracking cookies.

A bipartisan Consortium of Privacy Regulators (California, Colorado, Connecticut, Delaware, Indiana, New Jersey, Oregon) now coordinates enforcement across states. This is worth watching, but the fundamental opt-out model is unlikely to change.

EU Cookie Consent Rules Country by Country

Every EU country requires opt-in consent before you can store cookies or use localStorage for ad tracking. This is based on the ePrivacy Directive (2002/58/EC), which each member state has transposed into national law. The ePrivacy Regulation that would have replaced this directive is gone: the European Commission announced the withdrawal in February 2025 and approved it on 16 July 2025, so the national ePrivacy rules stay in force.

One critical legal point: localStorage is treated identically to cookies under the law. The European Data Protection Board confirmed this in its Guidelines 2/2023 (final version adopted 16 October 2024). Switching from cookies to localStorage does not avoid consent requirements.

France: CNIL cookie fines and consent rules

Law: Article 82 of the Loi Informatique et Libertes Enforcer: CNIL Realistic attribution: 28-40%

France is the strictest market in the world for cookie enforcement. The CNIL has issued the largest cookie-related fines globally:

• Google: EUR 325 million (September 2025) for ads shown between Gmail messages without consent and for cookies accepted at Google account creation without free consent
• SHEIN: EUR 150 million (September 2025) for placing trackers without consent and not respecting users' refusal
• Criteo: EUR 40 million (2023) for failing to verify that partners obtained valid consent
• Google: EUR 150 million (2021) and EUR 100 million (2020) for earlier cookie violations

The CNIL requires that "Accept" and "Reject" buttons have equal friction. If accepting takes 2 clicks and rejecting takes 6, that is a violation, and a "Continue without accepting" option must be equally prominent.

No official consent rate exists for France. Our working estimate is that with a compliant banner only about a third of French users accept marketing cookies, which would leave roughly two thirds of your French ad traffic without attribution data.

What the Criteo ruling means for you: If your site stores GCLID/FBCLID for ad platforms, you could be held liable for the entire tracking chain, not just your own code.

Germany: TDDDG consent rules and court rulings

Law: TDDDG Section 25 (formerly TTDSG, renamed in 2024) Enforcer: BfDI + 16 state-level DPAs Realistic attribution: 30-50%

Germany has some unique developments that make it especially strict:

• A Hannover court ruled in March 2025 that Google Tag Manager itself requires consent before activation, not just the tags it fires. This means even your tag management infrastructure needs to be gated behind consent.
• Germany's Consent Management Ordinance (EinwV, effective April 2025) is creating a standardized consent framework. No services have been certified yet, but this is unique to Germany.

Fines under TDDDG can reach EUR 300,000 per violation. GDPR fines (up to EUR 20 million or 4% of global turnover) apply on top when personal data is involved.

With 16 independent state DPAs that can each enforce separately, the enforcement landscape is fragmented but active. Consent rates in Germany vary widely with banner design; our planning range is roughly a quarter to a half of visitors.

Netherlands: AP cookie monitoring at scale

Law: Telecommunicatiewet Article 11.7a Enforcer: AP (Autoriteit Persoonsgegevens) Realistic attribution: 35-50%

The Dutch data protection authority runs the largest systematic cookie monitoring program in the EU: approximately 10,000 websites scanned annually, with plans to warn 500 organizations per year.

In April 2025, the AP issued warnings to 50 organizations (retailers, media companies, insurers) for misleading cookie banners. Those who received warnings were given 3 months to comply before formal investigations began.

The AP has sent specific "cookie letters" about Google Analytics 4 usage, requiring proper consent before GA4 can set any cookies. If you serve Dutch customers, expect your site to be scanned.

Italy: Garante cookie banner requirements

Law: Article 122 of the Codice delle comunicazioni elettroniche Enforcer: Garante per la protezione dei dati personali Realistic attribution: 40-55%

The Garante issued detailed cookie guidelines in 2021 with specific requirements:

• "Accept All" and "Reject All" buttons must be present and equally formatted on the first layer
• An "X" close button must function as rejection, not acceptance
• Scrolling does not constitute consent
• Cookie walls are not allowed

Enforcement has been less aggressive on cookies specifically compared to France or Germany, but the Garante has imposed significant GDPR fines in other areas (EUR 79.1 million against Enel Energia in 2024), signaling willingness to enforce.

Spain: LSSI-CE rules and analytics exemption

Law: LSSI-CE Article 22 Enforcer: AEPD Realistic attribution: 45-60%

Spain is moderately strict. Notable fines include EUR 30,000 for Vueling and EUR 20,000 for SEAT for cookie consent failures. Maximum cookie-specific fines are capped at EUR 30,000 under LSSI-CE, though GDPR fines can apply on top.

An interesting development from January 2024: Spain now exempts certain analytics cookies from consent, but this only covers basic audience measurement without cross-site tracking. Advertising click IDs (GCLID, FBCLID) are explicitly not exempt.

Belgium: daily penalties for cookie violations

Law: GDPR implementation law (cookie rules merged into GDPR in 2021) Enforcer: APD/GBA Realistic attribution: 40-55%

Belgium is unique because cookie violations are treated as direct GDPR violations since 2021. The APD uses an aggressive daily penalty payment model:

• Mediahuis (September 2024): EUR 25,000 per day per website for non-compliant banners
• RTL Belgium (October 2024): EUR 40,000 per day for missing "Reject All" button

These are not one-time fines. They accumulate every day until compliance is achieved.

Austria: TKG 2021 and the noyb factor

Law: TKG 2021 Section 165(3) Enforcer: DSB Realistic attribution: 40-55%

Enforcement has been low so far (maximum cookie-specific fine is EUR 50,000), but there is a significant risk factor: noyb (None of Your Business), the most active privacy activist organization in Europe, is headquartered in Vienna. noyb files complaints across the EU, and any non-compliance by companies serving Austrian users could quickly become a test case.

Central and Eastern Europe: opt-in, low enforcement

Poland, Czech Republic, Hungary, Romania, Croatia, and other CEE countries all have opt-in consent requirements (with Poland being a partial exception due to a browser-settings loophole in Article 173). Enforcement is generally low compared to Western Europe.

The Czech Republic switched from opt-out to opt-in on January 1, 2022, and has since conducted 39 in-depth cookie analyses with modest fines totaling approximately EUR 60,000.

For practical purposes, stores targeting CEE markets can expect 60-75% attribution with compliant consent banners, though the legal requirement for consent is the same as in Germany or France.

United Kingdom: ICO cookie sweep and PECR fines

Law: UK GDPR + PECR Enforcer: ICO Realistic attribution: 45-60%

The UK's Data (Use and Access) Act 2025 (DUAA, Royal Assent 19 June 2025) lets organisations use some low-risk cookies without consent, but advertising cookies still require opt-in consent.

In January 2025 the ICO announced it would bring the UK's top 1,000 websites into cookie compliance. It had already assessed the top 200 and written to 134 of those organisations about their banners.

Under the DUAA, PECR fines rise to UK GDPR levels: up to GBP 17.5 million or 4% of global turnover, a major increase from the previous GBP 500,000 cap.

Switzerland: nFADP high-risk profiling rules

Law: nFADP (new Federal Act on Data Protection, effective September 2023) Enforcer: FDPIC Realistic attribution: 45-60%

Switzerland has a hybrid model. Simple analytics may operate under disclosure plus opt-out, but ad Click ID tracking that enables cross-site profiling is classified as "intensive intrusion" / high-risk profiling and requires explicit opt-in consent.

The enforcement model is unusual: the FDPIC cannot impose administrative fines directly. Instead, violations are subject to criminal prosecution by cantonal authorities, with fines up to CHF 250,000 against responsible individuals (not the company). The FDPIC can also publicly disclose investigated parties (naming and shaming).

The FDPIC updated its cookie guidelines in October 2025, significantly tightening requirements.

Brazil: LGPD opt-in consent requirements

Law: LGPD (Lei Geral de Protecao de Dados) Enforcer: ANPD Realistic attribution: 50-65%

Brazil requires opt-in consent for non-essential cookies. The ANPD has imposed over BRL 98 million (approximately USD 20 million) in fines since 2023, including ordering Meta to suspend using personal data for AI training without consent.

Enforcement is maturing rapidly, and a potential EU adequacy decision for Brazil could further align standards. For stores targeting Brazilian customers, GCLID/FBCLID tracking requires consent, but compliance across Brazilian e-commerce is still inconsistent.

Canada (Quebec): Law 25 opt-in consent

Law: Law 25 (Act to modernize legislative provisions as regards the protection of personal information) Enforcer: CAI (Commission d'acces a l'information) Realistic attribution: 45-60%

Quebec is the only North American jurisdiction with a GDPR-style opt-in requirement for cookies. Fully in force since September 2023, with penalties up to CAD 25 million or 4% of global revenue.

If you serve both Quebec and other Canadian customers, you need to either detect Quebec visitors and apply stricter rules, or apply the Quebec standard universally.

Federal privacy reform (Bill C-27, which would have modernized PIPEDA) died when Parliament was prorogued in January 2025. Check the status of any replacement federal bill before relying on PIPEDA's opt-out model for the rest of Canada.

Illustrative estimate based on the ranges in the table above, not measured data.

What Google and Meta Do When Consent Is Denied

Understanding how Google and Meta respond to a denied consent is critical because it affects your attribution even when you follow the rules perfectly.

Google Consent Mode v2

Google requires advertisers to collect consent from users in the EEA and pass the consent signals to Google to keep using its tags for measurement and ad personalisation. When a user denies consent:

1. No ad cookies are stored, and if you turn on ads_data_redaction, the GCLID is also redacted from the consent pings and page URLs Google receives. On iOS, Google also uses privacy-safe alternatives called gbraid and wbraid.
2. GA4 sends anonymous pings without cookies (basic timestamp, user agent, referrer only)
3. Google applies conversion modeling to estimate missed conversions
4. No remarketing audiences can be built from non-consented users

Conversion modeling only starts once you reach 700 ad clicks over 7 days per country and domain grouping. At an average CPC of EUR 2.50, that is approximately EUR 7,500 per month in ad spend, so smaller advertisers will not qualify.

Even where modeling runs, modeled conversions are an estimate, not observed orders.

Meta Consent Mode for EU advertisers

Meta similarly requires CMP integration for EU advertisers. When consent is denied:

• The Meta Pixel switches to privacy-preserving mode (no advertising data transmitted)
• CAPI filters personal data and sends only aggregated signals
• Meta applies statistical modeling to estimate conversions

Meta removed the previous 8-event-per-domain limit in June 2025, but the fundamental data loss from consent denial remains.

How Server-Side First-Party Tracking Changes the Equation

Here is where the picture gets more nuanced, and more hopeful.

Browser-based tracking (GA4, Meta Pixel, standard JavaScript) is hit by three problems simultaneously: consent denial, ad blockers, and Safari ITP cookie limits. Server-side first-party tracking avoids two of those three.

Consent decides how many ad clicks you are allowed to tie to an order. Server-side tracking only removes the losses from ad blockers and short browser cookie lifetimes for the users who do consent.

For US traffic, where consent is not required, server-side attribution approaches near-complete coverage. You are not fighting any of the three problems.

Our own numbers show what that looks like in the EU stores we measure. In Enalitica's data, last 90 days to 28 September 2026 (nearly 12,000 orders), 26.4% of orders carried any paid click ID (14.7% a Google gclid, 12.4% a Meta fbclid). The rest were attributed from the session, referrer or landing page, and what consent hides is marked unknown rather than handed to a channel.

Even in opt-in Europe, a browser tool is not the ceiling: in the stores Enalitica tracks, GA4 saw 76.6% of the orders that actually happened.

Enalitica captures Click IDs at the order level, server-side. For every order that comes through your WooCommerce or Shopify store with a Click ID attached, Enalitica reads it directly from the order data, not from a browser cookie that might have been blocked or expired. This means:

• US/Australia/Canada traffic: near-complete attribution, because almost nobody opts out
• EU/UK traffic: Full attribution for consented orders, with no additional losses from ad blockers or cookie expiration
• Server-side conversion tracking: Enalitica sends conversions back to Google Ads (Enhanced Conversions) and Meta Ads (Conversions API) from your server, bypassing browser limitations entirely

Consent and Tracking Setup Checklist by Market

If your customers are in the US, Australia, or Canada

1. Implement Click ID tracking on your store (PHP + JavaScript, see our guide to capturing GCLID and FBCLID in WooCommerce)
2. Disclose tracking in your privacy policy
3. Add a "Do Not Sell" link for California compliance
4. Enjoy near-complete attribution. You are in the best position globally.

If you sell to EU, UK, or Swiss customers

1. Install a Consent Management Platform (CookieBot, CookieYes, or Complianz) that blocks tracking code until consent is given
2. Gate Click ID capture behind consent. Your CMP must block both cookie and localStorage code until the user consents to marketing cookies
3. Set up Google Consent Mode v2 with default "denied" for EEA visitors
4. Accept the data gap and focus on maximizing what you can capture from consented users
5. Use server-side tracking to eliminate ad blocker and cookie expiration losses for consented users
6. Invest in your tracking consent banner design. A clear, honest banner is the only lever you have on the consent rate, within the equal-friction rules above

If you sell globally

1. Apply the strictest rules by default (opt-in consent for all visitors), or use geo-targeting to apply country-specific rules
2. Set up server-side conversion tracking to maximize data quality for every consented user
3. Use multi-touch attribution to get value from partial data. Start from the store's own orders, not from GA4, which in Enalitica's data missed roughly one order in four
4. Check how your attribution tool handles consent. A tool that starts from browser events has to model its way back to the order; see server-side tracking vs order-based attribution for the difference

Frequently Asked Questions

Is localStorage really treated the same as cookies under EU law?

Yes. The EDPB (European Data Protection Board) confirmed this explicitly in its Guidelines 2/2023, adopted in final form on 16 October 2024. Article 5(3) of the ePrivacy Directive is technology-neutral. It applies to "storing of information, or gaining access to information already stored, in the terminal equipment." This covers cookies, localStorage, sessionStorage, IndexedDB, and any other client-side storage mechanism. Switching from cookies to localStorage does not avoid consent requirements.

Can I track Click IDs server-side without consent?

Not in the EU. Even if you capture the Click ID from the URL on your server (never writing it to client-side storage), you are still processing personal data (the Click ID is linked to an identifiable individual). GDPR consent requirements apply to the data processing, not just the storage mechanism. The ePrivacy Directive covers the storage aspect, while GDPR covers the processing aspect. You need consent for both in opt-in countries.

What is the minimum ad spend for Google's conversion modeling to work?

Google requires at least 700 ad clicks over 7 days per country and domain grouping for its conversion modeling to activate. At typical CPCs, this translates to a rough EUR 5,000-10,000 per month in ad spend per country. Smaller advertisers will not qualify, and their non-consented conversions will simply be invisible.

How does Enalitica help in markets where consent limits tracking?

Enalitica reads Click IDs directly from your order data (server-side), not from browser cookies. When a user consents and the Click ID is saved to the order, Enalitica reads it from the order itself, so ad blockers and cookie expiration no longer decide whether the click is counted. Additionally, Enalitica's server-side conversion tracking (Enhanced Conversions for Google, CAPI for Meta) sends conversion data back to ad platforms from your server, which is more reliable than browser-based pixels. In markets like the US where consent is not an issue, this gives you near-complete attribution coverage.

I sell in both the US and the EU. Should I show consent banners to US visitors?

There is no legal requirement to show cookie consent banners to US visitors (except for the "Do Not Sell" link for California). Many stores use geo-targeting to show consent banners only to EU/UK/Swiss visitors and skip them for US traffic. This maximizes your US attribution while staying compliant in Europe. Your CMP should support this configuration.

How often do privacy laws change?

Frequently. In 2025 alone: the EU withdrew the ePrivacy Regulation proposal, proposed the Digital Omnibus Regulation, Germany enacted the Consent Management Ordinance, the UK passed the Data Use and Access Act, and multiple US states enacted new privacy laws. We recommend reviewing your compliance setup at least quarterly. At minimum, check your consent rates, verify your CMP is blocking correctly, and review any new enforcement actions in your key markets.

Enalitica onboarding takes just a few minutes. For e-commerce stores, your last 30 days of orders are imported and enriched with click ID and Google Ads data instantly. Service businesses get all tracked events imported immediately. Want to see how your attribution holds up across different markets? Book a demo and we will show you exactly what you can track in each country you sell to.