The State of Privacy-First Analytics in 2023

2023 was the year privacy-first analytics stopped being a forward-looking strategy and became something almost every business had to deal with directly, largely because Google forced the issue.

The GA4 deadline forced everyone’s hand

Google announced that Universal Analytics, the version most businesses had used for a decade, would stop processing new data on July 1, 2023, and pushed everyone toward Google Analytics 4. GA4 was built around a fundamentally different measurement model: event-based tracking instead of session-based, and much heavier reliance on modeling to fill gaps left by browsers blocking cookies and users declining consent. Businesses that hadn’t migrated by mid-2023 lost access to new data entirely, which made this the single biggest forced change in marketing analytics that year, regardless of anyone’s opinion on cookies specifically.

Modeled data became normal

Because Safari and Firefox already blocked third-party cookies and a growing share of EU users were declining tracking consent under GDPR, a meaningful chunk of the funnel became invisible to direct measurement. GA4 and ad platforms responded by leaning harder on modeling, using patterns from consented, measurable users to estimate the behavior of users who couldn’t be tracked. Google’s Consent Mode, which adjusts what data is collected based on a visitor’s consent choice and then models the rest, went from a niche feature to something Google actively pushed advertisers toward, especially for EU traffic under GDPR’s stricter consent requirements.

This wasn’t a fringe technical detail. It meant conversion numbers in dashboards were increasingly a mix of directly measured and statistically estimated data, and marketers who didn’t understand that distinction were making budget decisions on numbers that were partly guesses.

A new wave of US state privacy laws

California’s CPRA, an expansion of the CCPA, took effect January 1, 2023, adding stricter rules around sensitive personal information and giving Californians more control over data. Virginia’s Consumer Data Protection Act took effect the same day. Colorado’s and Connecticut’s privacy laws followed on July 1, 2023, and Utah’s took effect at the end of the year. For any business operating across state lines, 2023 was the first year privacy compliance stopped being a single GDPR-shaped problem and became a genuine patchwork.

Server-side tracking moved from advanced to standard

As browser-based tracking got noisier, server-side tagging, routing analytics and ad pixel data through a business’s own server instead of directly from the browser, went from an advanced technique used mostly by large enterprises to something mid-sized businesses started adopting too. It gave more control over what data was sent where and improved measurement resilience against ad blockers and browser restrictions, at the cost of more setup complexity than the old drop-a-pixel-and-done approach.

What this meant in practice

Businesses that treated 2023 as a forced but valuable reset came out ahead. Migrating to GA4 meant rebuilding reports and dashboards from scratch, which was a real cost, but it also meant most teams finally took an honest look at what they were measuring and why, instead of running on inherited Universal Analytics configurations nobody remembered setting up.

The honest state of privacy-first analytics in 2023 wasn’t that measurement got worse. It got less precise in some ways and more deliberate in others. Businesses that leaned into first-party data collection, clean consent management and server-side tracking had more reliable numbers to work with than those still hoping cookie-based measurement would somehow hold up. The ones still waiting for things to go back to how they were before found the wait kept getting longer.

---

Keep exploring: browse more Marketing Analytics guides, see everything we published in 2023 or check out the Digital Business Marketing Awards.