CriticalChecked on every planEU · UK
Trackers fire before consent
Can my website load Google Analytics or Meta Pixel before the visitor consents?
Not in the EU: analytics and advertising scripts that load, or set cookies, the moment a visitor lands need prior consent. In the UK, advertising needs consent too, but since February 2026 analytics may run first if visitors are told and can object. Block trackers until the visitor says yes.
Why it matters
In the EU, non-essential cookies and trackers need prior consent. In the UK, advertising and cross-site tracking do too; only analytics may run first, under conditions (reported separately for UK sites). Loading trackers first is the most common reason regulators fine cookie banners, and it is trivial for them to prove from a browser.
What we show you when we find it
Every row opens the exact request, the cookie and a screenshot of the page at that moment. Example from an anonymised scan. See the full sample report.
How to fix it
- Block analytics and ad tags until consent is given. Use your consent tool’s auto-blocking, or Google Consent Mode v2 with default “denied”.
- In Google Tag Manager, fire marketing tags on a consent trigger instead of “All Pages”.
- Move hard-coded pixels (Meta, TikTok, LinkedIn) into the consent-gated tag manager.
- Re-scan to confirm nothing loads before the banner is answered.
Steps for OneTrust
- Mark each tracking tag with its OneTrust category (snippet below).
- Using Google tags? Turn on Google Consent Mode in your template.
- Load the OneTrust script first in your page head.
Steps for Cookiebot
- In Cookiebot Manager, open Settings, then Your scripts.
- Switch to Automatic blocking and copy the new script.
- Paste it as the very first script on every page.
- Using Google tags? Turn on Consent Mode in the Cookiebot tag, with defaults set to denied.
Steps for Usercentrics
- Open Configuration, then CMP Settings, and turn on Google Consent Mode.
- Add the default-denied script below, high in your page head.
- Add other tags as services in Usercentrics, or through its GTM template, so they wait.
Steps for Didomi
- Open Consent notices, edit your notice, then step 2 Customization.
- Open Integrations, then the Consent Modes tab.
- Turn on Google Consent Mode V2 and tick the Google vendors you use.
- Leave the “Set the default status” options off, so everything starts denied.
Steps for CookieYes
- Open Advanced Settings and turn on “Support GCM”.
- Keep “Allow Google tags to fire before consent” off.
- Put the CookieYes script first in your page head, before other tags.
- Press “Check GCM status” to test.
The law behind this rule
A plain summary, not legal advice.