Stop tracking visitors from selected countries
Country controls let you keep your website open while stopping Attriboo visitor measurement in selected countries. They are off until a website owner or admin saves a selection. The full setup has two parts: save the countries in Attriboo, then publish tracking code that checks those countries before it starts. Existing customers are not switched on automatically.
Instructions reviewed
Choose the control that matches your goal
| Your goal | Use this control | Effect on revenue attribution |
|---|---|---|
| Track only after visitor permission | Consent-manager connection | Accepted visits can still be connected to sales; rejected visits are not recorded by the supported tracker. |
| Stop measurement in selected countries | Country controls in Privacy & data | No new visitor journeys or checkout tagging for excluded visits. Their new marketing-to-sale matches are lost. |
| Count pageviews without browser identifiers | Cookieless measurement | Daily totals do not connect visits to payments. Country controls can exclude these totals too. |
| Filter unwanted standard traffic before storage | Tracking & exclusions | Existing page, hostname, IP and country rules discard matching standard events; those rules alone do not stop browser identifiers. |
| Keep a report focused on a country | Report filters | Changes the view only. Collection continues. |
| Remove older information | Retention or a verified deletion request | Removes covered stored records; country controls do not erase history. |
Set up countries for one website
- Choose the website, then open Settings → Privacy & data.
Find Country controls. You must be a website owner or admin to save a change. Each website has its own selection.
- Enable Don’t track visitors from selected countries.
This changes the form only. Nothing is saved yet, and the website remains open to visitors.
- Select Add EU/UK countries, or add individual countries.
The shortcut adds the EU, the UK, Norway, Iceland and Liechtenstein, including separately listed EU territories. It keeps any other countries you already selected. Review the selected list and remove entries you do not want.
- Read the revenue limits and confirm that you understand them.
When any countries are selected, unknown locations also stay off. The setting covers both standard browser tracking and cookieless pageviews or daily estimates.
- Select Save country controls.
The server begins declining excluded measurement after the setting is saved. Your other consent, email-capture, retention, payment and traffic-exclusion settings are not changed. You still need the updated installation for the browser to stop before creating its identifier.
Publish the country-aware installation
- Open Setup for the same website and copy its updated tracking code.
Saved country controls add data-country-control="true" to the standard or cookieless snippet. The updated code also uses a fresh tracker URL so an older browser-cached file does not silently ignore the setting.
- Replace the previous installation and publish your website.
Update the theme, site-wide head, tag manager or framework location you originally used. Remove duplicate old copies. If one old tag starts first, it can still create browser storage even though the server discards excluded measurement.
- Keep your consent integration connected.
The country decision and the visitor’s consent must both allow tracking. A country result of allowed does not grant consent. A rejection or withdrawal still keeps tracking off.
- Reload an already open page and test the published version.
Country-aware code reads the saved choice on each new page load. Previously open tabs do not instantly remove their old browser state when an admin saves a new setting. Clear the website’s publishing cache if it still serves the old installation.
<script defer data-site-id="site_example" data-consent="required" data-country-control="true" data-auto-identify="false" src="https://www.attriboo.com/t.js?v=regions-1"></script>WordPress setup
- Save the country selection in Attriboo first.
Choose your website in Attriboo and save Country controls under Privacy & data.
- Install the updated Attriboo plugin, version 1.5.0 or later.
Download it from Setup. Keep a backup of your website, update the plugin using your normal WordPress process, then open WordPress Settings → Attriboo.
- Enable Country controls in the plugin and save.
This adds the browser check. Keep the same measurement mode and consent setup you chose in Attriboo. Publishing an old snippet as well as the plugin can bypass the browser-side block.
- Review the WooCommerce order connection separately.
Country controls do not stop WooCommerce or another payment connection from sending orders and buyer details. Change that connection separately if you want to stop those imports; website cookie consent does not automatically control server-side orders.
What stops, and what stays
| Information or feature | For a new excluded visit |
|---|---|
| Standard visits, goals and form-email capture | The updated tracker does not start them, and the server declines excluded measurement. |
| New Attriboo browser identifier and checkout tagging | The updated standard tracker does not create or attach them. It removes its supported browser identifier when the check refuses the visit. |
| Cookieless pageviews and daily visitor estimates | Not recorded. The server does not create the daily estimate signature for an excluded request. |
| Post-checkout survey answers | The updated tracker does not show the survey, and excluded or unknown survey submissions cannot update a payment’s source answer. |
| New visitor journey and source-to-sale matching | The excluded visit supplies no new journey or source information to match to a later purchase. |
| Payment-provider sales and buyer details | Still imported by a connected provider unless you separately stop that connection. |
| Older records and earlier attribution | Remain available under their existing retention rules. Earlier visits or identifiers may still link a later purchase. |
| Your website, account, checkout and support | Remain available. Other tools on your website have their own behavior and settings. |
Test before relying on the setting
Country is inferred from the network request. VPNs, proxies and incorrect geolocation can change the result, so a test location is not proof of a person’s residence or legal status. If the policy request fails or does not return an explicit allowed: true, country-aware browser code stays off.
- Check the actual script tag on a published page.
It must contain data-country-control="true" and the correct website ID. Check that there is only one installation. A saved dashboard option alone does not prove the installed browser code has changed.
- Open browser developer tools and inspect Network.
The updated tracker calls /api/v1/tracking-policy?siteId=YOUR_SITE_ID without a visitor ID, page path or referrer in its payload. An excluded or unknown request returns allowed: false. Hosting providers still receive the IP address and request headers needed to answer it.
- Check an excluded test location.
Use a test visit you control. After an allowed consent choice, allowed: false must still prevent new /collect or /cookieless measurement calls. For the standard tracker, check that no new _atb_vid identifier is created. A cookieless installation does not manage storage left by an older standard installation.
- Check a non-excluded test location and consent choices.
Allowed: true must still wait when your installation requires consent. Test acceptance, rejection and later withdrawal. Confirm a permitted test visit reaches the expected website’s report.
- Inspect the payment report separately.
Do not expect imported sales to disappear. Review unmatched sales and any older links. Use your provider’s test environment for payment experiments; do not make an unnecessary live purchase just to test country controls.
Understand the server protection
Standard collection uses the trusted hosting country supplied by the browser collector. The database applies the country rule before writing visitor or event rows and before increasing measured usage. When country controls are enabled, measurement submitted without that trusted request-country is treated as unknown and ignored, including direct normalized event/API submissions. An API caller’s claimed country is not a way to bypass the browser restriction.
Cookieless collection checks the same saved countries before recording a pageview or calculating a daily estimate. The post-checkout survey also checks the country before looking up or changing an order’s source answer. Existing traffic-exclusion rules still apply to standard events separately. The country-policy check reads website settings but creates no visitor analytics record.
An older installed script can still read or create its browser identifier before the server refuses its event. That is why publishing and testing the country-aware installation is a required part of the setup.
Change or turn off the control
Add or remove selected countries and save again. Enabling a different list requires reviewing the revenue explanation again. To turn the control off, clear Don’t track visitors from selected countries and select Save country controls. Other consent and traffic-exclusion settings remain in place.
A country-aware installation reads the new server setting on its next page load. You can keep that installation after switching the control off. When no countries are selected, the control does not exclude unknown locations. It does not backfill visits that were never recorded or rebuild their missing marketing history.
Earlier browser records, exported files, provider records and historical analytics have separate handling. Use the retention and verified privacy-request tools when removal is required; do not use a country setting as a deletion tool.
What this does for privacy
This control reduces visitor measurement. It does not provide consent for another tracker, change your advertising, stop customer accounts or payment imports, appoint a privacy representative, or decide whether a particular law applies to your business. Those questions depend on what your business actually does.
Keep an accurate privacy notice and describe the processing that remains. Cookieless counts, a country list or a random identifier should not be described as an automatic GDPR exemption. Review account, payment, hosting and other provider arrangements separately.
You are done when
A published, tested country-aware installation keeps excluded and unknown locations off, while permitted visits still follow your consent setup. Payment imports and historical records remain separate.
Still need a hand?
Send a question without needing to sign in.