Trackers and cookies before consent: how to make the banner actually block them
A consent banner only counts if analytics and ad tags wait for the click. Check in a fresh browser, then wire the tags to the consent platform or Consent Mode.
Step by step, with screenshots: What are cookies on a website? First-party, third-party, session and persistent →
Check your own site
Runs these 2 checks and the other 191, free, in about 45 seconds.
Or run only this check with the free Cookie scanner (GDPR consent).
What it is
Trackers before consent means analytics, advertising or session-recording scripts that run, and set cookies such as _ga, _fbp or _gcl_au, before the visitor has answered the cookie banner. The banner is on screen, but the tags do not wait for it.
In the EU, the ePrivacy rules require prior consent to store or read anything on a visitor's device that is not strictly necessary, and the GDPR governs the personal data those trackers collect. Regulators check exactly this: France's CNIL fined Google 100 million euros in 2020 partly for cookies placed before consent.
OK looks like this: in a fresh browser, no tracking request is sent and no tracking cookie is set until the visitor clicks accept; session, security and consent cookies are fine. getReport loads the page without consenting and lists the trackers and cookies that appear anyway.
What a passing site looks like
- Only necessary cookies are set before consentwarning · −2.5 ptseffort M
- No trackers load before consentwarning · −2.5 ptseffort M
2. Trackers before consent
Why it matters. Analytics, ad pixels and session-recording scripts that run before the visitor answers the cookie banner set identifiers without permission. Under GDPR and ePrivacy that needs prior consent; regulators fine for it, and the banner is worthless if the tags do not wait for it.
- Load tracking tags through your consent platform (Cookiebot, OneTrust, Complianz, CookieYes, Google Tag Manager with consent triggers) so they run only after "Accept". Test in a fresh incognito window: no tracker request until you click.
- If you use Google tags, add Consent Mode v2 with the defaults set to denied; the tags then send cookieless pings until consent.
Questions people ask
What is GDPR cookie consent?
It is the permission a website must get before using cookies or similar tracking that is not strictly necessary for the service the visitor asked for. Consent must be freely given, specific, informed and a clear action such as clicking accept, and it must be as easy to refuse or withdraw as to give.
Does Google Analytics need cookie consent?
In the EU and UK, yes, in almost all cases: Google Analytics sets cookies and collects data that count as non-essential tracking. Load it only after consent, or use Google Consent Mode so it sends cookieless signals until the visitor agrees. Some privacy-friendly analytics tools can run without consent.
What are the GDPR cookie consent requirements?
Block non-essential cookies and trackers until the visitor agrees, explain what each category does, make rejecting as easy as accepting, do not pre-tick boxes, record the consent, and let visitors change their mind at any time. Strictly necessary cookies, such as a shopping cart or login, do not need consent.
Are cookies personal data under GDPR?
Cookie identifiers that can single out a device or person, such as analytics and advertising IDs, count as personal data under the GDPR. The cookie rules in the ePrivacy Directive apply either way: storing or reading any non-essential cookie needs consent, whether or not it holds personal data.
Do strictly necessary cookies need consent?
No. Cookies needed to deliver what the visitor asked for, such as a session, a shopping cart, load balancing, security or remembering their cookie choice, can be set without consent. You still describe them in your cookie policy. Analytics and advertising cookies are never strictly necessary.