Hey Reader!

I'm seeing a pattern in consent management configuration audits that's becoming a concern. People check the Consent Settings in the GA4 admin, see that signals are being received, and assume everything's configured correctly. Unfortunately, receiving signals doesn't mean your configuration is actually working correctly.

This matters because you could be violating GDPR right now without realizing it.

Let me walk you through an example. Sites set their default to opt-out for people in the European Economic Area (as you should), but when I actually test the configuration with a VPN set to an EEA location in an incognito browser, cookies are being set immediately when someone visits the site, or they show up after you select “no cookies”.

The only sure-fire way to catch these issues is to test every consent scenario you've configured in your CMP by setting your VPN to different regions. Use incognito browsers when you’re testing to ensure that you’re viewing the site as a brand-new person would. Make sure to open Chrome DevTools and look under Application > Cookies and Network to see what’s actually going on.

I recommend making this part of a monthly analytics check, because all it takes is one developer adding HubSpot to a site without checking with anyone first, and now you're in violation of GDPR. It’s very easy to get out of compliance and it can be a very expensive mistake.

If you haven’t tested out your consent setup before, I have a walkthrough here that can get you started! That’s a free lesson from my Google Analytics Audits course.

If you have questions about testing your consent setup, just hit reply and I'm happy to answer.

Dana DiTomaso Founder ​dana@kpplaybook.com

What ChatGPT's Atlas Browser Looks Like in Your GA4 Data

When ChatGPT released their Atlas browser, I immediately wanted to see how it would impact analytics tracking. We started testing it at Kick Point right away, and I've documented exactly what you'll see in your GA4 data.

TLDR: Atlas shows up as Chrome in your reports, but GA4 cookies don't transfer when people import their Chrome data into Atlas. This means your returning visitors will show up as "new users" when they switch browsers, even if they've been coming to your site for years.

If your audience includes marketers, developers, or AI enthusiasts, you might see this pattern in your data. I'm watching for unexpected bumps in new users from Chrome without corresponding traffic increases—that's your signal that Atlas adoption is happening.

Read my complete guide on what to watch for →

A Walk Through 25 Years of Google Ads Evolution

Ginny Marvin, Google's Ads Product Liaison, published a thoughtful retrospective on 25 years of Google Ads that I included because partly I can't believe it's been 25 years! But what I appreciate about this piece is how it connects the historical context to where we are now.

I think Ginny does a good job of explaining from the Google perspective why the job of managing ads has changed from tactical execution to strategic guidance. The fundamentals of marketing haven't changed, but how we work definitely has.

Making Sense of First, Second, and Third-Party Data

Maryna Semidubarska at Stape published a comprehensive guide to customer data analytics that I included because there's real confusion out there about what first, second, and third-party data actually means, and which types you should be prioritizing.

What I find valuable here is the practical breakdown of how to collect, store, and use customer data while staying privacy-compliant. The guide covers everything from obtaining clear consent to implementing server-side tracking.

This matters because privacy regulations aren't getting simpler, and first-party data is becoming your most critical asset. If you're still heavily relying on third-party data or haven't upgraded your tracking infrastructure, this guide gives you a roadmap for what needs to change.

When Thoughtless Code Creates Surveillance Networks

Juliana Jackson reached out to me last Wednesday with something alarming while checking her Google Search Console: random people's private ChatGPT prompts were showing up as search queries in her analytics. We're talking about deeply personal conversations appearing in her data because of a prompt box on OpenAI's site.

I included this because it's a perfect example of thoughtless code creating unintended consequences. If Juliana's seeing this in her data, thousands of other site owners are too.

Juliana asked me for my thoughts on this, and it fits right into what I said last week on LinkedIn about how people search now: people use the internet as a conversation engine now, not a search engine. These weren't search queries—they were private conversations that people thought were confidential. The fact that they're leaking across the internet into random people's analytics shows how surveillance infrastructure can be created through incompetence.

Join Me at ConvEx by VWO

Later this month I'll be leading a workshop on the Insights track at ConvEx by VWO. I'm still working on the outline, but the workshop will be part of the Insight track (no big surprise there!).

Registration is free, so this is worth checking out. More details coming soon!

That's it for this edition of The Huddle. As always, if you have questions or want to share what you're working on, just hit reply!

Want more? You got it!