What changed, and what to do about it
Every post covers one change in the tracking and analytics stack — a platform feature, a deprecation, an enforcement action — with the same structure: what changed, who's affected, the impact rating, and the action needed. Claims cite primary sources; where our crawl data can quantify the change, it does.
What €475M of CNIL cookie fines actually punished — and what your banner audit misses
On September 1, 2025, France's CNIL fined Google €325M (cookies set during account creation without valid consent, plus ads inserted between Gmail emails) and Shein's Irish subsidiary €150M (advertising cookies placed the moment users arrived, before any accept/reject choice). Both companies had consent UIs. The fines were for what happened before and despite them.
→ Audit firing order, not banner presence: capture a fresh-profile page load and verify no advertising cookie or beacon fires before consent. Then check the banner names its purposes and third parties — incompleteness was part of the findings.
GA4 now buckets AI-assistant traffic natively — check your custom channel groups
GA4 now measures AI-assistant referrals natively: recognized assistant traffic gets a new 'ai-assistant' medium value, an 'AI Assistant' default channel, and '(ai-assistant)' campaign labels (rolled out May 13, 2026). Historical data is not reclassified, and custom channel groups do not update themselves.
→ Annotate May 13, 2026 in your reporting. If you run a custom channel group with an AI channel, add a medium = ai-assistant condition to it (or retire it deliberately) so custom and default groupings stop telling different stories.
Google Tag Gateway: first-party Google tags without a server container
Google tag gateway for advertisers is now generally available: it serves the Google tag and routes its measurement traffic through your own domain using your existing CDN, load balancer, or web server — no server-side GTM container needed. What launched as the 'first-party mode' beta is now a mainstream, one-click-on-Cloudflare deployment path.
→ Implementers: evaluate gateway vs. sGTM before building new first-party infrastructure — for Google-only needs the gateway is dramatically less work. Compliance: re-confirm consent gating, because first-party hosting changes none of your legal obligations while making tags harder for outsiders to spot.
The GPC enforcement wave: a record fine, a tri-state sweep, and the finding that breaks most implementations
Regulators stopped warning and started fining. A September 2025 joint sweep by California, Colorado, and Connecticut targeted businesses ignoring Global Privacy Control; since February 2026 it has produced the largest CCPA settlement to date (Disney/ABC, $2.75M), a $1.1M CPPA action (PlayOn Sports), and a ~$375K action (Ford). The Disney order establishes that honoring GPC on the signaling device only is a violation — for a logged-in user, the opt-out must apply across the consumer's entire relationship.
→ Test that your site receives AND processes GPC end-to-end, then fix the three patterns the fines named: device-only scope for known users, opt-outs redirected to third parties, and identity-verification steps in front of opt-out requests (prohibited).
Every article lands in The Tracking Wire the same week, alongside the changes that didn't warrant a full brief.
Weekly. Free. One-click unsubscribe. Opens Substack in a new tab — you won't lose your place here.