Marketing teams add tracking scripts, legal teams buy a cookie consent banner, and many of those sites still drop advertising cookies before the visitor clicks anything. This article covers cookie consent and tracking script compliance from a technical point of view: how to check which scripts actually fire before consent, why a banner alone does not make a site compliant, and how to set up blocking so it holds up after the next tag manager change.
The benefit is concrete. A site that respects consent is less exposed to regulatory fines, loads less third-party code, and leaves attackers fewer injection points.
What the Law Actually Requires From Your Scripts
In the EU, the main rule is Article 5(3) of the ePrivacy Directive, not the GDPR. Storing or reading anything on a user’s device requires prior consent unless it is strictly necessary for a service the user asked for. This covers cookies, localStorage and fingerprinting alike. The GDPR then defines what valid consent means: freely given, specific, informed and unambiguous.
The Court of Justice of the EU confirmed in the Planet49 ruling (October 2019) that pre-ticked boxes do not count as consent. In January 2022, the French CNIL fined Google €150 million and Facebook €60 million because refusing cookies took more clicks than accepting them. Regulators look at what the browser actually does, not at what the banner says.
Session cookies, CSRF tokens, load balancer affinity cookies and shopping cart state are generally exempt. Analytics, A/B testing, advertising pixels, heatmaps and embedded social widgets are generally not. For the wider security obligations that sit next to consent, see the overview of GDPR security requirements for websites.
A Familiar Scenario: The Tag That Fired Too Early
A mid-sized e-commerce site runs Google Tag Manager with a commercial consent management platform (CMP) such as Cookiebot, OneTrust or Usercentrics. The audit at launch looked clean. Six months later, a marketing contractor adds a Meta Pixel and a TikTok Pixel directly in GTM with the trigger set to “All Pages”. There is no consent condition on either tag.
The banner still appears and still records choices. The `_fbp` cookie is set about 200 milliseconds after page load, whatever the visitor chooses. Nobody notices until a data subject complaint comes in. The fix takes ten minutes. Working out how many months of non-compliant data collection happened takes much longer.
The pattern is very common. The CMP works fine, but the tags are not wired to it.
How to Audit Cookie Consent and Tracking Script Compliance
An experienced web security auditor starts with a clean browser and tests the default state first, because that state is the one that matters most legally. The process takes about 15-20 minutes per site:
1. Open a fresh incognito window with DevTools open on the Network tab, with “Preserve log” enabled, then load the page without touching the banner.
2. Filter requests for known tracking domains: google-analytics.com, googletagmanager.com, connect.facebook.net, analytics.tiktok.com, bat.bing.com, hotjar.com, clarity.ms.
3. Check Application → Cookies and Local Storage for identifiers like `_ga`, `_gid`, `_fbp`, `_gcl_au`, `_hjSessionUser` or `_clck`.
4. Click “Reject all”, reload, and repeat both checks. Nothing non-essential should appear.
5. Accept only one category, such as statistics, and confirm that marketing tags still stay silent.
Repeat the audit on a deep product page, the checkout and a landing page with UTM parameters. Templates differ, and hardcoded scripts often sit in a single page template that the CMP’s auto-blocker never sees.
Busting the Anonymized IP Myth
A persistent misconception says Google Analytics with IP anonymization, or any “cookieless” analytics, needs no consent. That is wrong in most EU jurisdictions. GA4 still sets client identifiers and sends data to Google, and IP truncation does not change the device-access question under ePrivacy. Several European data protection authorities, starting with Austria in January 2022, ruled that specific Google Analytics deployments violated EU data transfer rules.
Some genuinely cookieless tools, such as self-hosted Matomo configured without cookies, or Plausible, may qualify for exemptions in certain countries. France’s CNIL publishes an exemption framework for audience measurement. That exemption applies to specific configurations and is not a blanket rule. Check the configuration against your regulator’s guidance before you drop consent.
Consent Mode, Server-Side Tagging and the Edge Cases
Since March 2024, Google requires Consent Mode v2 for advertisers that target users in the EEA. The “basic” implementation blocks Google tags completely until the user consents. The “advanced” implementation loads tags immediately and sends cookieless pings when consent is denied. Many legal teams consider advanced mode risky under strict ePrivacy readings, because the tag still loads and contacts Google’s servers.
Server-side GTM moves tag execution to your own subdomain, which hides vendor domains from the network tab. It does not remove the need for consent. It only makes violations harder for auditors and for you to spot.
Context changes the rules. A US-only site that is subject to CCPA/CPRA works on an opt-out model, and since January 2024 California regulations have required sites to honor Global Privacy Control signals. Intranets and B2B portals behind authentication still need consent for non-essential tracking, because employees are data subjects too. Small teams of under 10 people without a dedicated privacy lead should choose fewer tags over more complex consent logic.
Common Mistakes Practitioners Make
The first mistake is trusting the CMP’s auto-blocking without verifying it. Auto-blockers rewrite script tags that they recognize. Inline scripts, scripts that are injected dynamically, and vendors that are missing from the CMP’s database often slip through.
The second mistake is auditing once at launch. Tag containers change every week. A marketing user with publish rights in GTM can break compliance without any code deployment, so code review never catches it.
The third mistake is ignoring the security side. Every tracking pixel is third-party JavaScript running with full access to your DOM, including checkout forms. If the vendor’s CDN is compromised, the script becomes a skimmer. Subresource Integrity rarely works for vendor scripts that change often, but a strict CSP allowlist limits the damage. Read more on the security impact of third-party JavaScript libraries.
FAQ
Do I need consent for Google Tag Manager itself?
GTM’s base container sets no cookies on its own, so loading it before consent is generally accepted. The tags inside it are what need consent gating, and that gating must be configured per tag.
Is a “Reject all” button mandatory on the first layer?
Several regulators, including the CNIL and the German DSK, expect refusing to be as easy as accepting. A reject option hidden behind “Settings” is increasingly treated as non-compliant.
How often should consent behavior be tested?
Test after every tag manager publish and every theme or plugin update, and run a full audit at least monthly. Automated checks for unexpected cookies and new third-party domains catch most regressions between manual audits.
Keeping Consent Enforcement Reliable
Cookie consent compliance is a property of the browser’s behavior, not of the banner. Test the default state in a clean session, check every template, and treat every new tag as both a privacy change and a third-party code change. The most useful habit is to require an incognito network check before any GTM publish goes live. It takes two minutes and catches the most common failure.