Start free

HighChecked on every planEU

Session data sent before consent

Can Microsoft Clarity run before a visitor consents if it sets no cookies?

Short answer

Not safely. Clarity sets no cookies before consent, but it still sends clicks, scrolls and page views to Microsoft. EU regulators say that needs consent too. Load Clarity only after the visitor says yes.

3%of 168 European shops did this (5)
No. 4most common high problem in the study

Why it matters

Cookieless is Microsoft’s default in the EU until consent. But EU regulators read the cookie rule as covering any tracking script, with or without cookies (EDPB Guidelines 2/2023). Session recording is personal data, so ask first.

How to fix it

  1. Load Clarity only after consent: set it to “Analytics” or “Marketing” in your consent tool, so the tool blocks it until the visitor accepts.
  2. Or keep it loaded and send consent through Clarity’s Consent API or Google Consent Mode, with recording held until the visitor says yes.
  3. Run the scan again to confirm nothing goes to clarity.ms before a choice.
Steps for OneTrust
  1. Mark each tracking tag with its OneTrust category (snippet below).
  2. Using Google tags? Turn on Google Consent Mode in your template.
  3. Load the OneTrust script first in your page head.
OneTrust docs, checked October 2026
Steps for Cookiebot
  1. In Cookiebot Manager, open Settings, then Your scripts.
  2. Switch to Automatic blocking and copy the new script.
  3. Paste it as the very first script on every page.
  4. Using Google tags? Turn on Consent Mode in the Cookiebot tag, with defaults set to denied.
Cookiebot docs, checked October 2026
Steps for Usercentrics
  1. Open Configuration, then CMP Settings, and turn on Google Consent Mode.
  2. Add the default-denied script below, high in your page head.
  3. Add other tags as services in Usercentrics, or through its GTM template, so they wait.
Usercentrics docs, checked October 2026
Steps for Didomi
  1. Open Consent notices, edit your notice, then step 2 Customization.
  2. Open Integrations, then the Consent Modes tab.
  3. Turn on Google Consent Mode V2 and tick the Google vendors you use.
  4. Leave the “Set the default status” options off, so everything starts denied.
Didomi docs, checked October 2026
Steps for CookieYes
  1. Open Advanced Settings and turn on “Support GCM”.
  2. Keep “Allow Google tags to fire before consent” off.
  3. Put the CookieYes script first in your page head, before other tags.
  4. Press “Check GCM status” to test.
CookieYes docs, checked October 2026

The law behind this rule

EUePrivacy Directive Art. 5(3): cookies need prior consentEUEDPB Guidelines 2/2023: the cookie rule covers cookieless tracking tooEUGDPR Art. 4(11), 6 & 7: valid consent

A plain summary, not legal advice.

Real case, anonymised

Shopify’s banner and a fingerprinting script that ignored it

On Shopify, the banner only controls what asks it. Apps that don’t ask keep tracking.
Read the case