GDPR, cookies, and consent with SourceLoop

The 30-second decision

Your situation	What to do
Your visitors are in the US (or outside the EU/UK)	Nothing. Keep a privacy policy and you’re done.
You have EU/UK visitors and want the simplest setup	Turn on Cookieless mode (one toggle, usually no banner needed).
You have EU/UK visitors and want maximum accuracy	Keep the default install and gate it with a consent tool.

Whichever you pick, SourceLoop already honors browser privacy signals (Global Privacy Control, Do Not Track) and Google Consent Mode automatically. You do not have to configure those.

How SourceLoop tracks, in plain terms

• It is a first-party script on your own site. No third-party pixels.
• By default it uses first-party cookies to recognize a returning visitor, which gives the best accuracy.
• Your visitor’s IP is processed but stored only as a hashed value, never in the raw.
• When someone submits a form, it captures the lead details (such as email) to attribute the conversion.

All of this data goes only to your own SourceLoop account.

Option A: Do nothing (US and non-EU audiences)

GDPR is an EU and UK law. If your business and visitors are in the US, you fall under US rules (such as CCPA), which are opt-out, not opt-in. That means you do not need an “accept first” cookie banner.

What you should still do:

• Keep a privacy policy that mentions you use analytics.
• That’s it. SourceLoop already respects the browser opt-out signal (Global Privacy Control), so anyone who opts out is excluded automatically.

This covers the majority of sites.

Option B: Cookieless mode (privacy-first, usually no banner)

If you have EU or UK visitors and want the easiest compliant setup, turn on Cookieless mode.

How to enable it:

1. Open your website’s Tracking code page in SourceLoop.
2. Toggle on Cookieless mode (GDPR) and click Use cookieless tracking in the dialog that explains what changes.
3. Copy the updated snippet and replace the one on your site.

What it does:

• Sets no cookies and no local storage. Nothing persistent is stored on your visitor’s device.
• Visitors are recognized by a privacy-friendly server signal that resets every day, so there is no long-term identifier following anyone around.
• Because nothing is stored on the device, you usually do not need a cookie-consent banner. This is the same approach used by privacy-first analytics tools like Plausible and Fathom.

The tradeoff:

• Slightly lower accuracy for returning visitors and long multi-touch journeys. Because the signal resets each day, the same person can look like a new visitor on a different day.
• The per-visitor views, such as an individual’s journey in Contacts, are turned off. Aggregate reports keep working.

Best for: EU-heavy sites that want the simplest compliant setup and are comfortable with a small loss in long-window accuracy.

Option C: Consent management tool (full accuracy, fully compliant)

If you want the most accurate attribution from the people who do consent, keep the default install and let a consent banner control it.

One thing to know first: a basic cookie banner is just a popup. By itself it does not actually block anything. To genuinely gate tracking you need a consent tool that can hold scripts until the visitor accepts. Common options, most with free tiers: Cookiebot, CookieYes, Termly, Iubenda, OneTrust, Osano.

There are two easy ways to wire it up.

1. Tag the snippet in your consent tool. Mark the SourceLoop script as analytics or marketing, and the tool holds it until the visitor accepts. For a Cookiebot-style tool, the script tag looks like this:

<script type="text/plain" data-cookieconsent="statistics">
window.SourceLoopConfig = { websiteId: 'YOUR_WEBSITE_ID' };
</script>
<script type="text/plain" data-cookieconsent="statistics" async src="https://t.sourceloop.ai/tracking-v3.js"></script>

The type="text/plain" plus the data attribute is what keeps it switched off until the visitor accepts. The exact attribute name differs per tool, and each one documents it.

2. Use Google Consent Mode v2. If your banner supports Consent Mode, just set analytics to denied by default. SourceLoop reads it automatically and stays completely off (no cookies, no events) until the visitor accepts, then turns on.

The tradeoff:

• Visitors who reject are not tracked, including their conversions. That is the correct and compliant outcome, and it is the same for every analytics tool. You keep full, accurate data for everyone who accepts.

Best for: EU sites that want maximum accuracy from consenting visitors.

What SourceLoop already does for you

No setup required for any of this:

• First-party only. No third-party cookies.
• IP stored hashed, never raw.
• Honors Global Privacy Control and Do Not Track. If a visitor has these on, tracking is disabled or personal data is stripped automatically.
• Reads Google Consent Mode v2 from your banner if present. Analytics denied means no tracking; ad-user-data denied means no email or phone is sent; ad-storage denied means no ad click IDs.

Erasing a person’s data on request

When someone asks you to delete their data under GDPR’s right to erasure, an admin can do it from SourceLoop:

1. Open Settings, then Privacy.
2. Choose the Website and enter the person’s Email address.
3. Click Erase.

The contact record, their conversions, visitor history, and analytics events are erased. Payments, subscriptions, and deals are kept but detached from the person, so revenue totals stay correct. The person disappears from the app at once, and analytics deletions finish within a few hours. Erasure can’t be undone, and every erasure is recorded in the audit log.

Which should I choose?

• US or non-EU audience: Option A. Do nothing.
• EU audience, want it simple: Option B. Cookieless mode.
• EU audience, want best accuracy: Option C. Consent tool.

You can switch any time by changing your snippet, so it is easy to start simple and revisit later.