GDPR cookie consent: trackers before consent

The rule

The wording covers any storage of, or access to, information on the device. It is not limited to cookies, and it has no size threshold. A tag that reads a device identifier is within it in the same way a cookie is.

Penalties sit in two layers. The directive leaves them to the Member States, which must lay down rules that are “effective, proportionate and dissuasive” (Art. 15a), so the ePrivacy side is sanctioned under national law. The GDPR side is separate: Article 83(5)(a) places “the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9” in the upper tier, with a ceiling of EUR 20 million or 4% of worldwide annual turnover. The check’s citation lists Art. 83(4)/(5); the consent conditions are in paragraph 5.

What PeekWell checks and how

EU-01 asks one question: did anything that is not strictly necessary load before the visitor answered the banner? The scan answers it from what the browser did, not from what the site says it does.

The scan opens a public page in a fresh browser context with no saved choices, the way an ordinary visitor’s browser would. It records every network request and every cookie written as the page loads, without touching the banner. The request domains and cookie names are then compared with a maintained list of tracker signatures, grouped by purpose: analytics, advertising and session replay. A match that appears before any consent event becomes a finding, and the requests themselves are the evidence.

The decision is made by code from that evidence. A language model may help write the explanation in the report, but it never decides that a tracker fired. Severity starts at critical and scales with the number and type of trackers seen.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. It does not read your contracts or decide what a tag is for beyond the category on its list, and a list only knows the trackers on it. Collection that happens on a server, or inside an app, is outside what a browser visit can see. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

For an authority this is one of the easiest facts to establish, because it can be observed from outside with a clean browser. In procedure PS/00080/2023 the AEPD opened a website with its history and cookies cleared, took no action on the page, and recorded Google Analytics performance cookies (_ga and _gid) and a targeting cookie in use. The decision, which also covers privacy-notice and design-pattern findings, includes EUR 5,000 under Article 22.2 of Spain’s LSSI for the cookie setup.

The same pattern runs through the decisions listed below. The CNIL’s SHEIN decision records cookies placed before visitors interacted with the banner, and a Refuse all button that did not stop them. The Romanian authority ordered the cookie setup reconfigured so that cookies need prior consent.

For a company the practical consequences are of three kinds. Authorities can check the facts themselves, as the AEPD did here after a complaint reached it. Consent has to be demonstrable under Article 7(1), so a banner that is present but not wired to the tags proves little. And data that reaches an advertising or analytics vendor before the visitor chose has already left; fixing the banner afterwards does not recall it.

Smaller companies and larger companies

The rule has no size threshold, and the same facts decide it for a five-person startup and for a listed group. What differs is how the problem arises and how it shows up.

In a small company the site is often built from a template or a hosted builder. Someone in marketing adds Google Analytics, an advertising pixel and a chat widget, and a banner plugin is switched on. The banner is real, but one of the tags was pasted straight into the theme, so it loads on every visit before the banner is answered. There is often no privacy team to notice, so a complaint may be how it comes to light, as it did in Romania. Smaller companies are within reach of authorities: the Romanian decision listed below ended in a fine of 10,000 lei and an order to correct the setup.

In a larger company there are more moving parts. A tag manager holds dozens of tags owned by different teams and agencies, the site spans several domains and apps, and a release can change which tags fire and in what order. Consent state has to carry across all of it, and the company has to be able to show it did. Scale also changes the stakes: the CNIL noted that around 12 million French residents visit shein.com each month.

How to fix it

1. See what loads first. Open your site in a private window with the browser’s network tab open. Do not touch the banner. Write down every third-party request and cookie that appears.
2. Block by default in your consent tool. Mark analytics, advertising, session replay and chat as blocked until the visitor accepts. Most consent tools have a per-category setting for this. A category left on allowed is one way a banner can exist while tags still run.
3. Start tags from the consent tool’s callback. In a tag manager, fire each tag on the consent tool’s accept event rather than on page load. Pasted scripts in the theme, a plugin or the page template need the same treatment, or they need to go.
4. Set Google’s consent mode to denied before any Google tag. Google’s guide asks for the default call on every page before any command that sends measurement data, and says defaults will not work if the order is wrong. Then update the state when the visitor accepts.
5. Re-scan. Clear cookies and storage, reload, and run a scan again. The finding should disappear once nothing non-essential loads before the choice.

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
});

Consent mode changes what Google’s tags store and send. Whether it satisfies a given authority is a question for your legal adviser, and Peeky reports only what it sees.