How to Set Up Privacy-Safe Tracking for Cannabis Sites

Why cannabis data deserves extra caution

Not all analytics data is equal. A record that someone browsed and bought cannabis ties a person to a purchase that many still treat as private, and it often carries location data on top of that. Regulators increasingly view health-adjacent and precise-location data as sensitive. So the standard "install the tag and forget it" approach that works for a shoe store is a poor fit here. Build tracking that assumes the data is sensitive from the start, because for a lot of your visitors it is.

Set up Consent Mode v2 in GA4

If you run GA4 or Google Ads, Consent Mode v2 is the practical backbone of compliant tracking. It ties your tags to a consent choice: when a visitor accepts analytics and advertising cookies, tags fire normally; when they decline, tags fall back to cookieless pings and Google models the missing conversions. Pair it with a consent banner that actually blocks tags until a choice is made, not a cosmetic one that tracks anyway. Done right, you respect the decline and still get usable aggregate reporting.

Know which laws reach your visitors

US privacy law is a patchwork, and which rules apply depends on where your visitors sit, not just where you operate. California's CCPA as amended by CPRA and the Colorado Privacy Act are two you will commonly encounter, and both give people the right to opt out of the sale or sharing of personal data. Cannabis-specific rules can add more on top. The point is not to memorize statutes, it is to build in an opt-out mechanism and a data practice that can satisfy the strictest law your traffic touches. Confirm the specifics with counsel; this is not legal advice.

Prefer cookieless and first-party measurement

The industry is moving away from third-party cookies regardless of cannabis, and for a sensitive category you have extra reason to move first. Cookieless and privacy-first analytics report the things SEO actually needs, traffic volume, sources, landing pages, page performance, without stitching together an individual profile that follows someone across the web. You give up some user-level detail — you keep the channel and content trends that drive decisions. For this space, that is a good trade.

Be clear about what you collect

Openness is both expected and, increasingly, required. A plain-language privacy notice that says what you collect, why, and how someone opts out does more for visitor trust than legal boilerplate nobody reads. In a category where people are already privacy-conscious, being straight about your data practices is a trust signal, not just a checkbox.

A worked example

A dispensary had a basic GA4 install firing on every visit with no consent gate. Facing California and Colorado traffic, they added a consent banner wired to Consent Mode v2 and switched their tags to respect the decline. Reported sessions dropped by a chunk at first, which alarmed the owner, until modeling filled part of the gap and the channel trends held steady. They lost some user-level reports and kept every number they used to make SEO calls, while removing a real liability — that is the trade in practice.

Frequently asked questions

What is Consent Mode v2 and do I need it?

Consent Mode v2 is how Google tools adjust their behavior based on whether a visitor has consented to analytics and advertising cookies. When someone declines, tags send cookieless pings instead of full tracking, and Google models the rest. If you use GA4 or Google Ads and serve regions that require a consent choice, you effectively need it. This is not legal advice.

Which US privacy laws apply to a cannabis site?

It depends on where your visitors are. California's CCPA as amended by CPRA and the Colorado Privacy Act are two common ones, and both grant opt-out rights for sale or sharing of personal data. Because cannabis touches health-adjacent and location data, some rules treat it as more sensitive. Confirm which laws apply to you with qualified counsel; this is general information, not legal advice.

Can I still get useful analytics without invasive tracking?

Yes. Cookieless and privacy-first analytics can report traffic, sources, and page performance without building individual profiles, and Consent Mode modeling fills gaps from declined consent. You lose some granularity, but the trends that actually drive SEO decisions survive. For a sensitive category, that trade is usually worth making.