Ok, I will try not to rant a lot this post, but I might fail. Also, it’s 30+ degrees outside, so keeping cool is smart.
Your consent setup is broken*)
*) probably
It’s summer 2026 . Consent Mode has been around for ages, every CMP vendor has a shiny “GDPR-ready” badge, and yet… things keep firing before anyone has clicked “accept”.
People: Installing a cookie banner is not the same as being compliant.
A banner is a UI element.
Compliance is about what your browser does before the visitor touches that banner.
And then.. the GA4 collect call goes out. The Meta pixel fires. Some random session-recording script you forgot you installed in 2021 phones home. All before buttons were clicked.
And then the design: The Dutch AP and noyb have spent the last two years hammering on exactly this point: “reject all” has to be as easy as “accept all,” and nothing non-essential may load until the visitor actively agrees. TCF 2.2 is here now, and enforcement letters are sent out actively.
So the banner being present means nothing. The banner being correct is the challenge.
Where it goes wrong (often the same three things)
I’ve looked at a lot of tag setups. The leaks cluster around the same culprits:
1. The Google tag loads regardless of consent. People configure Consent Mode, set their consent defaults, feel good about it… and then load gtag.js directly in the <head> anyway. Consent Mode in basic implementation still loads the tag and just withholds the cookies. In advanced implementation it adjusts behaviour. The difference matters enormously, and most people don’t know which one they have running.
2. The CMP loads after GTM. Race conditions.. always fun. If your consent manager initializes some milliseconds after your tag manager, you have a window where tags fire freely. It’s the details that count.
3. “Defaults” that aren’t denied. Consent Mode lets you set default consent states before the user chooses. If those defaults are set to granted (or simply not set, which some setups treat as granted), you’ve are tracking people who never said yes.
Easy to fix. But you can’t fix what you can’t see.
Technical detour: how to actually look
Open DevTools in an incognito window, go to the Network tab, filter on collect or your pixel’s domain, hard-refresh the page, and don’t touch the banner. If you see requests going out before you interact… there’s your leak.
For Consent Mode specifically, type dataLayer in the console and look for the consent default push. Is it firing before the Google tag? Are the ad and analytics signals set to denied? If the default push is missing or comes late, Consent Mode isn’t protecting you the way you assume.
Do this on your own site right now. I’ll wait.. :-)
Some numbers
Checking one page in DevTools is fine for your site, n=1.
Meet my side project: consentchecker.eu
I’ve been building this to automate manually opening DevTools and being clever with manual checks.
Give it your URL, it loads the page like a real visitor, and tells you exactly which trackers fired before consent and which vendor each one belongs to. No login, no sales call. Run it on your own site and see where you land.
76% of scanned sites loaded trackers before consent. Three-quarters. Over two thousand individual tracking requests fired before a single visitor agreed to anything. Real shops with CMPs installed, all of them maybe believing they were compliant?
If your reaction is “surely not mine”: that’s exactly what the other 76% thought too.
Your turn!
Everyone loves checklists. Here’s one for you.
- Verify, don’t assume. Scan your own site via DevTools or this great free cookie consent checking tool (see what I did there?) and look at your report.
- Know which Consent Mode you’re running. Basic vs advanced changes everything. If you’re not sure, you’re probably on basic.
- Fix the load order. CMP before GTM, defaults set to
denied, tags gated behind a consent trigger. Boring, but hey, it’s work. - Re-check after every release. Tag setups change all the time. A well-meaning marketer adds one pixel through a “quick” GTM change and suddenly you’re back in the 76%.
Consent isn’t a banner you install once and forget. It’s a state your site has to maintain and the only way to know it works is by lookin.
/ end rant
Leave a Reply