Cookiebanner, consent & adblockers

Measure what your pixel no longer sees

Consent, ad blockers and browser restrictions determine which touchpoints can be measured. Roots reads your existing cookie banner, uses first-party measurement where permitted and can forward available conversions server-side with deduplication. Unmeasured events do not become visible afterwards.

View the signal loss dashboard View pricing

Where your measurement leaks today

Varies by site

Adblockers

Ad blockers can block known measurement scripts and requests. Roots reports the observed loss in your own traffic without promising a general percentage.

Safari + Firefox

ITP and ETP

Safari caps client-side first-party cookies at 7 days (or 24 hours for links with a click ID). Your view-through and longer funnel disappear.

Your visitors’ consent choice

Declined consent

Choosing necessary cookies only limits which data can be measured and shared. Modelled conversions are estimates, not directly observed events.

0 klikken

Offline conversions

Phone calls, showroom visits and deals that land in the CRM weeks later never reach bidding algorithms without a feedback loop.

Percentages vary widely by industry and audience. That is why Roots reports the loss measured on your own traffic instead of an industry average.

Consent

What we do and do not do per consent status

Status	Measurement in Roots	Forwarding to platforms
Consent given`granted`	Full measurement: visitor ID in first-party localStorage, click IDs, touchpoint history.	Server-side CAPI including hashed email/phone (SHA-256) for better match rates.
Marketing declined`denied`	First-party measurement in Roots: visit and session ID, URL, source and click IDs can be recorded.	No identifiers are forwarded to ad platforms. Only your own dashboard.
No CMP detected`unknown`	First-party measurement in Roots continues until a valid choice is received.	Not technically treated as a refusal. Only enable forwarding with a correctly connected cookie banner.

Banners we detect automatically

· Google Consent Mode v2 (dataLayer, ad_storage / ad_user_data)
· Cookiebot (Cookiebot.consent.marketing)
· CookieYes (getCkyConsent categories.advertisement)
· IAB TCF v2 (__tcfapi, purpose 7: measure ad performance)
· Your own banner via window.SR_CONSENT = 'granted' | 'denied'

Using something else? One line is enough to pass the status to the pixel.

<!-- connect your own banner -->
<script>
  // when marketing is accepted
  window.srAttribution.consent('granted');

  // when declined
  window.srAttribution.consent('denied');
</script>

Technology

Why our measurement holds up where platform pixels fail

First-party script and endpoint

You point a CNAME (e.g. metrics.yourdomain.com) to Roots. Script and collect endpoint then run on your own origin. Filter lists target known third-party hosts, which do not match here.

Neutral naming

No /collect?pixel=fb or /gtag/js in the path. No known tracker URLs and no recognisable query strings that EasyPrivacy catches.

No third-party cookies

The visitor ID is stored in first-party localStorage. If storage is blocked, a temporary in-memory session ID can be used. Repeat visits and sometimes conversion matching may then be lost.

sendBeacon with fetch fallback

Events are sent via navigator.sendBeacon, with keepalive fetch as a fallback. This increases the chance of sending an event during a quick exit or redirect without guaranteeing receipt.

Measuring the loss itself

A bait element and network probe indicate possible blocking. Browser and API signals provide additional context. The dashboard shows observed loss, not events that were never recorded.

Server-side recovery with deduplication

Every conversion gets a dedup ID. That ID is sent to Meta CAPI, Google Enhanced Conversions, LinkedIn CAPI and TikTok Events API so browser and server events count as one conversion.

The whole installation, in two steps

1. Point a CNAME from metrics.yourdomain.com to Roots. We handle the certificate and verify automatically.
2. Paste the script into your head. Forms, tel: and mailto: clicks are recognised as conversions right away; add custom events with one data attribute.

7.3 kB gzip, asynchronous; no server container to manage yourself.

<script async
  src="https://metrics.jouwdomein.nl/sr.js"
  data-key="sr_live_xxx"></script>

<!-- eigen conversie -->
<button data-sr-event="offerte_aanvraag"
        data-sr-value="450"
        data-sr-currency="EUR">
  Offerte aanvragen
</button>

What it gives you

From 'our report is wrong' to 'we steer on evidence'

Your bidding algorithms get fed again

Bidding algorithms use the signals they receive. Additional permitted conversion signals can make that input more complete; evaluate the effect on CPA or campaign performance over a fixed period.

Explain why figures differ

Put one independent measurement alongside GA4, Ads and Meta. Explain differences through measurement method, attribution model, measurement window and observed overlap.

Compliance is a selling point, not a brake

Data processing agreement, EU hosting, configurable retention, deletion requests and an audit log. Your legal or privacy officer gets answers instead of a debate.

Implementation without a long project

One script line, one CNAME. No GTM server container to host and maintain yourself, no Cloud Run bill that grows with your traffic.

Frequently asked questions

Do we need to change our cookie banner?: No. Roots reads your existing banner. To be explicit towards visitors, list Roots in your cookie statement under statistics/marketing; that is tidy and usually sufficient.
Is measuring without consent allowed?: The current script can record first-party visit and session data without marketing consent. With an explicit refusal nothing is forwarded to platforms. The legal basis and setup remain your responsibility as the data controller.
Do you bypass ad blockers?: No. With an explicit refusal we send nothing to ad platforms. An unknown status is not technically treated as a refusal, so connect a supported cookie banner before enabling forwarding. Ad blockers and browser restrictions can still block measurement.
How do you prevent double counting with server-side events?: Every event carries a dedup ID sent by both browser and server. Meta, TikTok and LinkedIn deduplicate on it; for Google we use conversion IDs with the same logic.
What if someone disables JavaScript entirely?: Then nobody measures anything, including us. That is why we also offer a server-side API and CRM webhook, so conversions created in your backend still arrive with the right source.

Find out how much you are missing

Put the pixel on one site and after a few days view your own signal loss by browser, consent status and channel. Then switch on server-side recovery.

Create account View the product