Media buying after the privacy reset

For a decade the pitch was simple: we will follow the person, we will bid on the person, and we will tell you what the person did. That pitch is thinner now. Apple made identifier collection on iPhones a permission. Browsers treated third-party cookies as a problem. Google promised to kill those cookies, delayed the funeral, then recast the project as a user-choice model. The industry kept selling “cookieless futures” through all of it.

The practical result for an Australian buyer is not that media stopped working. It is that the story about why it worked got less certain, and agencies that still talk as if every conversion is a tracked individual are selling 2019. This sits in the SEM agencies hub next to the operating detail in Google Ads agencies in Australia.

What actually changed

Three shifts matter. They get bundled because they arrived in the same years. They are not the same thing.

App tracking on iOS. After Apple's App Tracking Transparency prompt, a large share of iPhone users declined to be identified for advertising. Meta, Snap, and everyone who had built a business on a device ID lost a clean path from ad to install to purchase. They replaced it with modelled conversions, aggregated reporting, and a lot of confidence. The confidence is not the same as the old click trail.

Browsers and cookies. Third-party cookies — the ones a different domain sets on a site you are visiting — were already dying in Safari and Firefox. Chrome's plan to drop them became a saga. By the time this piece was updated, the web had not gone fully cookieless, and it had not gone back to 2018 either. What you can rely on is less deterministic cross-site identity, more noise, and more vendors selling a workaround.

Platform modelling. Google Ads, Meta, and the rest now fill gaps with models. They tell you more conversions happened than your own system recorded, and they are sometimes right. They are also marking their own homework. An agency that only reports the platform number is asking you to accept the seller's count.

None of this means you should stop buying. It means you should stop treating a dashboard to two decimal places as a measurement of the world.

First-party data, without the mystique

First-party data is information you collect because someone dealt with you: an email on an order, a booking, a logged-in session, a preference they ticked. It is not a magical audience. It is your filing cabinet.

It has become more valuable because the rented filing cabinets — cookies and device IDs you did not collect — are less reliable. Agencies will talk about “first-party strategies” as if the phrase were a product. The product is: a reason to collect the contact, a place to keep it, a way to send a conversion back to the ads platform, and a rule for when you may use the list again.

That last part is an OAIC conversation, not a media one. Under the Privacy Act and the Australian Privacy Principles you need a purpose for collecting personal information and a basis for disclosing it — including disclosing it to Google or Meta as a customer list. “The agency said it would improve ROAS” is not a purpose you can defend. “These people bought from us and we want to find similar customers, and we told them we use their information to run our advertising” is closer, if it is true.

Do not let an agency treat a leftover spreadsheet as an audience. Lists go stale, and lists from a franchisee are not always yours to upload. Server-side conversion tracking — sending the sale or qualified lead from your server — survives more browser quirks than a pixel. It is worth more than another retargeting vendor.

GA4, plainly

Google Analytics 4 is the current Analytics. It is event-based, not session-based in the old Universal Analytics sense. It models some of what it cannot see. It is fussier to set up, and a lot of Australian sites still have an implementation that was migrated in a hurry and never loved.

What a buyer needs to know:

GA4 is not a source of truth for revenue unless you have checked it against the finance system. It will disagree with Google Ads. It will disagree with Shopify or the CRM. The job is to know why, not to pick the number that flatters the campaign.

Enhanced measurement will fire events you did not ask for. Scrolls and outbound clicks can become “conversions” if someone is careless. That carelessness then trains the ads account. Ask what is marked as a conversion in GA4 and what is marked as a conversion in Google Ads. They should be a short, agreed list.

If they want admin access, give it in your account. A new property “to keep things clean” is how history disappears. Fix the thank-you page before you buy a modelling seminar.

Consent Mode, plainly

Consent Mode is Google's mechanism for listening to a consent signal — usually from a banner — and changing how its tags behave. If the person says no to ads or analytics storage, the tags should not behave as if they said yes. Google then uses modelled conversions to fill some of the gap.

It is not an Australian statute. The Privacy Act does not say “install Consent Mode v2”. What the Act does say, in the language of the APPs, is that you should be transparent about collection and careful with disclosure. A banner that lies, or a banner that is ignored by the tags, is a transparency problem regardless of what Google calls the feature.

Agencies push Consent Mode because Google has made it a practical requirement for certain modelled conversion features, especially if you have European traffic or you want the platforms to treat your consent signals as real. That can be a good reason. It is still plumbing. It does not make a weak offer convert.

Ask which banner fires the signal, whether the tags respect a decline, and what happens to reported conversions when consent rates are low. A site that sells only in Australia has a smaller consent problem than a retailer with an app and EU shipping. Do not buy an enterprise stack because a slide said “privacy-first”.

Clean rooms, plainly

A clean room is a place where two parties can compare or activate data without handing each other the raw customer file. Think of it as a locked room where your list and a publisher's list can be asked questions — overlaps, aggregated conversions — and neither side walks out with the other's spreadsheet.

They are real. They are also, for most Australian retainers, premature. Walled gardens offer their own versions. Independent clean rooms exist for holding companies and large advertisers. The setup costs, the legal work, and the need for a large, clean first-party list mean a $20,000 media month will not be transformed by one.

Buy the conversation when you have a data partnership worth protecting. Do not buy one because the strategy deck had a padlock. Most teams need a CRM they trust and an agency that will report your numbers next to the platform's.

What to demand from an agency

A measurement map in one page: sources, events, what is a conversion, what is modelled, what is ignored. Named owners for the analytics property, the tag manager, and the ad accounts — all in your company's name.

A weekly or monthly view that puts platform-reported conversions next to CRM or finance conversions. The gap is the story. If they will only show the platform, they are asking you not to look at the gap.

Honesty about incrementality. Geo tests, holdouts, and platform lift studies are imperfect. They are still better than last-click in a world of models. You will not run a perfect test every month. You should run one when you change spend a lot.

No new vendor whose only pitch is “identity resolution”. If you buy across search and social, make one team responsible for the map. The method in how to evaluate an SEO agency is about artefacts and ownership. Apply it to tags and lists.

What still works

Direct response still works when the offer is good and the landing page keeps the promise. Brand search still captures demand you already created. Creative still matters on the platforms that are now more like ads in a feed than like a keyword. First-party audiences — your actual customers, used carefully — still reduce waste.

What does not work is pretending the graph is as certain as it was when a cookie sat on every site. Buy media as if the numbers are directional and the offer is the thing you control. If you have lived through a messy measurement rebuild, the desk takes pitches on write for us.