Privacy-First Tracking for a German Dental Practice

The Client

A German digital marketing agency, working for a dental practice in Hamburg. The agency runs the practice’s website and Google Ads, and brought me in to set up conversion tracking and cookie consent on the practice’s WordPress site.

Dental practices in Germany handle health data, so the agency set strict rules up front: no tracking before consent, nothing that could reveal a treatment or condition, and no remarketing or personal data in Google Ads.

The Problem

The site had tracking tools installed, but they weren’t compliant and weren’t measuring what the practice needed.

• The cookie banner never appeared. The site’s domain wasn’t authorized in Cookiebot, so no visitor ever saw the banner or could give consent.
• Tags loaded from several places. Google Site Kit and Cookiebot each tried to load Google Tag Manager, which created duplicate consent events and made the setup hard to follow.
• URLs revealed treatments. Standard GA4 sends the full page URL and title. A visit to a page like /zahnimplantat-hamburg/ tells Google that a specific person is interested in dental implants, which can count as health data under Art. 9 GDPR.
• Automatic tracking collected sensitive details. GA4’s Enhanced Measurement captured internal search terms (such as “Zahnschmerzen”, toothache) and full outbound link URLs.
• The emergency link counted as a booking. Clicks on the emergency service link would have been reported to Google Ads as appointment conversions, and an event name like “urgent” would itself hint at acute pain.
• Form submissions were overcounted. The form trigger fired on every submit attempt, including ones that failed validation.

What I Did

Consent comes first in this setup, and every piece of data is cleaned in the browser before it reaches Google.

1. 01
   A visitor accepts statistics in the Cookiebot banner
2. 02
   One WordPress snippet loads Google Tag Manager
3. 03
   GTM variables sanitize the URL, title, and referrer
4. 04
   GA4 records page views, scrolls, and three generic events
5. 05
   Google Ads imports two conversions from GA4

Consent before anything loads
I fixed the Cookiebot domain authorization so the banner appears, and loaded Google Tag Manager through a single WordPress snippet that Cookiebot blocks until the visitor accepts statistics. Without consent, the browser sends no request to Google at all. I removed the duplicate tag loading from Site Kit and Cookiebot, so GTM now loads from one place only.

URL, title, and referrer sanitization
I wrote three GTM variables that rewrite what GA4 receives. They work from an allowlist: only pages like the homepage, team, or contact page keep their real path, every individual treatment page becomes /treatment/ with the title “Behandlung”, and any unknown page becomes /other/. Referrers are cut down to the domain, and only the URL parameters needed for ad attribution (gclid, gbraid, wbraid, basic UTMs) survive. Pages the practice adds later are generalized automatically.

Generic events only
There are three events with neutral names: appointment_click, contact_form_success, and facebook_click. A text-based rule keeps the emergency link out of bookings, including clicks on its icon, and the form event fires only when the success message appears, so failed submissions don’t count.

Locked-down GA4
Google signals, granular location data, and ads personalization are off, data retention is 2 months, and Enhanced Measurement is reduced to page views and scrolls. Site search, outbound clicks, and form interactions are disabled.

Google Ads without personal data
I didn’t put an Ads tag on the site. I linked GA4 to Google Ads and imported the two key events as conversions, so Ads only receives the already-sanitized data, with no Enhanced Conversions, remarketing, or audiences. I also disabled Jetpack Stats, which sent visitor data to the US.

Documentation for the data protection review
I wrote a German-language document covering every tag, trigger, consent category, event parameter, suppressed field, data transfer, and retention setting, so the practice’s data protection officer could approve the setup before go-live.

The Stack

Everything runs on the practice’s existing WordPress site; no new hosting or paid tools were added.

The Result

The practice now measures bookings and inquiries in GA4 and Google Ads, no treatment or health detail leaves the browser, and the agency has a setup its data protection officer could review line by line.

• 0 requests to Google before consent, verified in GTM Preview and the browser’s network panel.
• Every case tested: treatment pages, search parameters, consent accepted and rejected, the emergency link, and form errors.
• Delivered in 3 days, from the client’s compliance requirements to the published container and the German documentation.

The agency’s feedback on delivery: “Great, thank you so much.”

If your tracking has to hold up to a data protection review, hire me.