Yes, and for a Dutch agency the compliant approach is also the more credible one. Consent is deny-by-default, IP addresses are truncated and encrypted, and person-level identity resolution happens only when a visitor consents through a form. Company-level signals fill the gap where person-level consent is absent.
Can you track conversions and still comply with the AVG?
The AVG, the Dutch implementation of the GDPR, is not a reason to measure less. It is a reason to measure deliberately. The agencies that get this wrong either over-collect and carry real legal risk, or under-collect and lose the ability to prove the media worked. Neither is necessary.
Deny-by-default is the foundation. Targeting forwards to the ad platforms are suppressed unless consent has been decided and granted, rather than firing first and asking later. That single default is the difference between a tracking setup you can defend and one you have to apologize for.
IP handling follows the same posture. Addresses are truncated and encrypted at rest, with full-IP reveal audited rather than routine, and configurable storage and retention modes so you keep only what you need for as long as you need it. In production the system hard-fails without an encryption key configured, so there is no accidental plaintext path.
The part that trips people up is the difference between company-level and person-level data. When a visitor has not consented, Metiva can still surface the company or account behind a visit, which is legitimate business context. It resolves to a named individual only when that person consents through a form capture. Person-level tracking is the consented case, not the default.
This matters for the de-anonymization claim specifically. The honest version is company-level identification where consent is not present, person-level only on consent. That is a claim you can make to a data-protection-conscious client without a caveat you will later regret.
The reason this still proves ROI is that the conversions that matter, the ones that become revenue, come from consented, identified leads who filled in a form and became deals. You do not need to track everyone to prove the media worked. You need to track the right people correctly, and let the company-level layer cover the rest.