Consent-gated tracking