GDPR cookie consent: trackers before consent

The rule

The wording covers any storage of, or access to, information on the device. It is not limited to cookies, and it has no size threshold. A tag that reads a device identifier is within it in the same way a cookie is.

Penalties sit in two layers. The directive leaves them to the Member States, which must lay down rules that are “effective, proportionate and dissuasive” (Art. 15a), so the ePrivacy side is sanctioned under national law. The GDPR side is separate: Article 83(5)(a) places “the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9” in the upper tier, with a ceiling of EUR 20 million or 4% of worldwide annual turnover. The check’s citation lists Art. 83(4)/(5); the consent conditions are in paragraph 5.

What PeekWell checks and how

EU-01 asks one question: did anything that isn’t strictly necessary load before the visitor answered the banner? The scan answers it from what the page did, not from what the site says it does.

The scan is automated. It opens your public pages the way a first-time visitor’s browser would, with no choice saved, and notes any analytics, advertising or session-replay tool that starts before anyone touches the banner. Anything that starts early becomes a finding, and what the scan saw is the evidence.

The scan has limits, and the report says so. It sees the public pages it visited, and the members area when you give it a sign-in. It doesn’t port-scan, try to get in where it isn’t allowed, run any security test or open addresses nobody linked to. Collection that happens on a server, or inside an app, is outside what a browser visit can see. A Passed means the expected behaviour was observed on the pages scanned. It doesn’t say the site complies.

Why it matters for a company

For an authority this is one of the easiest facts to establish, because it can be observed from outside with a clean browser. In procedure PS/00080/2023 the AEPD opened a website with its history and cookies cleared, took no action on the page, and recorded Google Analytics performance cookies (_ga and _gid) and a targeting cookie in use. The decision, which also covers privacy-notice and design-pattern findings, includes EUR 5,000 under Article 22.2 of Spain’s LSSI for the cookie setup.

The same pattern runs through the decisions listed below. The CNIL’s SHEIN decision records cookies placed before visitors interacted with the banner, and a Refuse all button that did not stop them. The Romanian authority ordered the cookie setup reconfigured so that cookies need prior consent.

For a company the practical consequences are of three kinds. Authorities can check the facts themselves, as the AEPD did here after a complaint reached it. Consent has to be demonstrable under Article 7(1), so a banner that is present but not wired to the tags proves little. And data that reaches an advertising or analytics vendor before the visitor chose has already left; fixing the banner afterwards does not recall it.

Smaller companies and larger companies

The rule has no size threshold, and the same facts decide it for a five-person startup and for a listed group. What differs is how the problem arises and how it shows up.

In a small company the site is often built from a template or a hosted builder. Someone in marketing adds Google Analytics, an advertising pixel and a chat widget, and a banner plugin is switched on. The banner is real, but one of the tags was pasted straight into the theme, so it loads on every visit before the banner is answered. There is often no privacy team to notice, so a complaint may be how it comes to light, as it did in Romania. Smaller companies are within reach of authorities: the Urban Home decision listed below ended in a fine of 10,000 lei and an order to correct the setup.

In a larger company there are more moving parts. A tag manager holds dozens of tags owned by different teams and agencies, the site spans several domains and apps, and a release can change which tags fire and in what order. Consent state has to carry across all of it, and the company has to be able to show it did. Scale also changes the stakes: the CNIL noted that around 12 million French residents visit shein.com each month.

How to fix it

1. See what loads first. Open your site in a private window with the browser’s network tab open. Do not touch the banner. Write down every third-party request and cookie that appears.
2. Block by default in your consent tool. Mark analytics, advertising, session replay and chat as blocked until the visitor accepts. Most consent tools have a per-category setting for this. A category left on allowed is one way a banner can exist while tags still run.
3. Start tags from the consent tool’s callback. In a tag manager, fire each tag on the consent tool’s accept event rather than on page load. Pasted scripts in the theme, a plugin or the page template need the same treatment, or they need to go.
4. Set Google’s consent mode to denied before any Google tag. Google’s guide asks for the default call on every page before any command that sends measurement data, and says defaults will not work if the order is wrong. Then update the state when the visitor accepts.
5. Re-scan. Clear cookies and storage, reload, and run a scan again. The finding should disappear once nothing non-essential loads before the choice.

gtag('consent', 'default', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  analytics_storage: 'denied',
});

Consent mode changes what Google’s tags store and send. Whether it satisfies a given authority is a question for your legal adviser, and Peeky reports only what it sees.