Check explainer
Pre-consent cookies
Cookies set before the consent decision are a typical compliance finding.
- to review
- ok
What we check
Reads the Set-Cookie header of the first response, before any consent decision.
Why it matters
Cookies set before the consent decision are a typical compliance finding.
Common causes
- Server-side session or load-balancer cookies (PHPSESSID, AWSALB) are harmless but belong in the documentation as essential.
- A CDN or bot protection sets its own cookies, which are simply missing from the cookie documentation.
- The backend writes affiliate or attribution cookies with the very first response, before any consent.
- Server-side A/B testing assigns variant cookies before the consent decision.
How to fix it
Enable CMP tag-blocking; mark server-side session cookies (PHPSESSID etc.) as essential.
What does a failing Pre-consent cookies finding mean?
Cookies set before the consent decision are a typical compliance finding. Enable CMP tag-blocking; mark server-side session cookies (PHPSESSID etc.) as essential.
How do you fix Pre-consent cookies?
Enable CMP tag-blocking; mark server-side session cookies (PHPSESSID etc.) as essential.