Pre-consent scripts

Trackers referenced before consent only become a violation once they execute. The check lists the references; whether CMP blocking or Consent Mode stops execution is what the deep scan shows.

What we check

Looks for cookie-based trackers (GTM, gtag, Meta pixel, LinkedIn, TikTok and more) referenced in the HTML before consent. With Consent Mode active, the finding is graded to review instead of critical; whether anything actually fires is verified by the deep scan in the reject state.

Why it matters

Referenced does not mean executed. Under the EU ePrivacy rules, accessing device information needs consent, so what counts is what actually runs before opt-in. Basic Consent Mode blocks the tags entirely; advanced loads them and sends cookieless denied pings, whose legal standing is contested. A tag with neither simply fires. That is the critical case.

Common causes

GTM or gtag.js is built straight into the template instead of behind the CMP blocking.
Shop and CMS plugins inject their pixels themselves, bypassing the tag manager and the CMP categorisation.
"Just testing quickly" snippets from old campaigns were never removed again.
The CMP loads asynchronously, but the trackers already sit in the initial HTML.

The fix

Move every listed script behind the CMP blocking or the tag manager's consent triggers. Then the counter-test without interaction: load the page, click nothing, read the network tab. Whatever still sends, sends without consent.

Matching template

CMP and GTM Consent QA Template

The repeatable test plan for default-denied, consent update and reject, across all four signals.

Get the QA template →

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

What does a failing "Pre-consent scripts" check mean?

The scanner found cookie-based trackers referenced in the HTML before any consent. That is not a verdict yet, what matters is whether they execute. A cleanly blocking CMP (basic) stops them until opt-in; advanced Consent Mode loads them and sends cookieless pings with denied signals. Only when both are absent does data flow out without consent, and the finding is critical.

How do you fix a failing "Pre-consent scripts" check?

Set every listed script to "requires consent" in the CMP, or move it behind the tag manager's consent triggers. Then the counter-test without interaction: load the page, click nothing, and check the network tab for tracker requests. The deep scan of this check does exactly that automatically.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint