Cookies and trackers set before consent

Strictly necessary storage is exempt: a session identifier, a shopping basket, a load-balancing cookie, a security token, and the cookie recording the consent choice itself.

Everything else requires prior consent. Analytics is not exempt in most EU jurisdictions, although several regulators publish conditions under which a narrowly configured, first-party audience measurement may be treated as exempt.

The rule covers storage and access generally, not only cookies. Local storage, IndexedDB and device fingerprinting are all within scope, which is why removing cookies while keeping the fingerprinting changes nothing legally.

Consent must be prior, specific, informed and freely given, and it must be as easy to refuse as to accept.

A cookie wall that makes refusal impossible, or a banner where accepting is one click and refusing takes three, does not meet the freely-given standard.

The most common implementation loads the analytics tag in the page head and the consent banner as a component. The tag runs first, the banner appears second, and the sequence is already wrong.

A tag manager makes this worse: the manager loads, fires everything configured, and the consent integration only governs tags added after someone set it up.

Server-side tracking moves the request off the page and does not remove the obligation — the pixel fired on the server is still processing the visitor's data.

Embedded third-party content is frequently forgotten entirely. A video embed, a map, a social widget and a font service may each set cookies or make identifying requests before anyone has agreed to anything.

And rejecting frequently does less than accepting: a banner whose 'reject' path leaves several tags running is a common finding, and it is the one regulators have penalised.

Open the site in a private window with developer tools open before the page loads. In the Application panel, clear all storage, then reload and look at what is set before you touch the banner.

Anything beyond the strictly necessary set is the finding, and the cookie names usually identify the service directly.

Check `localStorage` and `sessionStorage` too, not only cookies. The obligation covers storage generally.

In the Network panel, look at requests to third-party domains made before the banner is answered. A request carrying an identifier is processing even if nothing is stored.

Then click reject and repeat. Tags that continue after a refusal are a more serious finding than tags that fire before a choice.

Load nothing non-essential until consent is recorded. The consent state has to be a gate that scripts pass through, not a preference they consult afterwards.

Move every non-essential tag behind the consent manager, including the ones added through a tag manager interface — those are the ones most likely to be outside the gate.

Treat embeds as tags. A video or map embed should be replaced by a placeholder until consent is given, which is also a performance improvement.

Make reject as prominent and as immediate as accept, and make it actually stop the tags rather than recording a preference.

Keep a record of consent, and re-ask when the purposes change rather than treating a past agreement as permanent.

Audit after every marketing change. Tags are added through interfaces that do not go through code review, so the gate is bypassed by ordinary work rather than by mistake.

`cookies.pre_consent` records the cookies set on a first, untouched page load — before any banner has been answered — and reports those that appear.

`privacy.trackers_before_consent` reports the tracking requests made in that same window, which covers the case where nothing is stored and an identifier is still transmitted.

`privacy.cookie_banner` and `privacy.reject_option` report whether a banner is present and whether a refusal path is offered, which is the other half of the requirement.

`privacy.tracker_inventory` and `cookies.third_party` list what was observed, so the finding is evidence rather than a verdict.

The scan observes an untouched load from outside the EU or inside it depending on where it runs, and a site that varies its behaviour by geography may behave differently for a real visitor.