Fixing Tracking That Runs Before Consent

Why tracking leaks past the banner

PECR requires consent before you store information on a visitor's device or read information from it, unless an exemption applies. The rule is about what the code does, not what the banner looks like. If a tag sets a cookie, writes to local storage or reads a device identifier on page load, the consent question has already been answered for the visitor, whatever they click next.

The usual routes by which tracking escapes the banner are:

• Hard-coded snippets. An analytics or pixel snippet pasted into header.php, theme.liquid or a static template runs before the consent tool has even loaded.
• Plugins and apps with their own tracking. Many SEO, shop, form and marketing plugins include an "add your tracking ID" option that injects the tag directly.
• Tag Manager tags on All Pages. Tags set to fire on every page view with no consent condition fire immediately.
• The consent script loading too late. If the consent tool is deferred or placed at the bottom of the page, other scripts win the race.
• Third-party embeds. YouTube, Vimeo, Google Maps, social feeds, review widgets and chat tools set their own cookies and storage when the iframe loads.
• Cached pages. A page cache or CDN may store a version of the page rendered after someone accepted, and serve it to everyone.

The strictly necessary exemption, and the newer exemptions added to PECR by the Data (Use and Access) Act 2025 for some low-risk purposes, do not cover advertising or social media pixels. For analytics, check the ICO's current guidance on any exemption and its conditions before treating a tag as allowed to load early. This guide assumes any tracking that is not clearly exempt waits for consent.

Finding the leaks in your browser

You do not need special software to see tracking before consent. A browser shows you everything:

1. Open a new private or incognito window, so there are no existing cookies or stored choices.
2. Open the developer tools before loading the site. In the Network panel, tick Preserve log and clear the list.
3. Load your home page and do not touch the banner.
4. In the Network filter box, try the domains below one at a time. Any request listed is a leak.
5. In the Application panel (Storage in Firefox), look at Cookies, Local storage and Session storage for your domain and third-party domains.
6. Repeat on a product or article page, a page with an embedded video, and a page with a form, because different templates load different scripts.

Google Consent Mode, explained plainly

Google's Consent Mode lets Google tags adjust their behaviour according to consent signals. Version 2 uses four main signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google requires advertisers who use its advertising features with visitors in the UK and EEA to send these signals. Consent Mode does not show a banner and does not collect consent; your consent tool does that and passes the result on.

The default state must be set before any Google tag runs. On a site without Tag Manager, that means a small block at the very top of the <head>:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'functionality_storage': 'denied',
    'personalization_storage': 'denied',
    'security_storage': 'granted',
    'wait_for_update': 500
  });
</script>
<!-- consent tool script next, then gtag.js -->

When the visitor chooses, the consent tool calls an update, for example gtag('consent', 'update', {'analytics_storage': 'granted'}), and the tags respond.

Basic and advanced implementations

Google describes two ways of using Consent Mode. In the basic approach, Google tags do not load at all until the visitor consents. In the advanced approach, the tags load straight away with consent denied and send cookieless pings that Google uses for modelling. Advanced mode does not set Google's cookies before consent, but it still sends requests from the visitor's browser to Google before they have chosen. If you want the cautious position under PECR and UK GDPR, the basic approach is the simpler one to defend. Whichever you choose, describe it in your cookie policy.

Making non-Google scripts wait

Consent Mode only controls Google's own tags. Everything else, from a Meta Pixel to a live chat widget, needs to be held back by your consent tool or tag manager. There are three common patterns:

1. Fire the tag from Tag Manager on a consent trigger

Remove the snippet from the site and recreate it as a tag in Tag Manager. Use your consent tool's template or built-in consent checks so the tag only fires once the matching category, such as marketing, is granted. Use the Consent Initialization trigger for the consent tool itself, so it runs before everything else.

2. Change the script type until consent

Many consent tools can activate scripts that are marked as inactive. The browser ignores a script whose type is not JavaScript, and the tool swaps it back after consent. The attribute names vary by tool, so check your tool's documentation; the pattern looks like this:

<!-- before: runs immediately -->
<script src="https://widget.example.com/chat.js"></script>

<!-- after: held until the "functional" category is accepted -->
<script type="text/plain" data-category="functional"
        data-src="https://widget.example.com/chat.js"></script>

3. Click-to-load placeholders for embeds

For video, maps and social posts, show a still image or a simple box with a button such as "Load video (YouTube will set cookies)". Only insert the iframe once the visitor clicks or has accepted the relevant category. The privacy-enhanced youtube-nocookie.com address reduces what YouTube stores before playback, but it still uses browser storage, so it is not a complete substitute for a consent check.

Where early tags hide on each platform

Also check the caching layer. After any change, purge the page cache and CDN, then confirm the first page view in a private window is served without tracking.

The fix, step by step

Server-side tagging, fingerprinting and email pixels

Server-side tagging

Moving tags to a server-side container changes where data is sent from, not whether consent is needed. If the setup still sets or reads cookies or identifiers in the visitor's browser for analytics or advertising, PECR still applies, and forwarding the data to vendors from your server is still processing under the UK GDPR. Server-side tagging can reduce what third parties receive, which is useful, but it is not a way around the banner.

Fingerprinting

Fingerprinting identifies a device by combining details such as screen size, fonts and browser settings instead of using cookies. The ICO has made clear that it regards fingerprinting as covered by the same rules on storage and access, and that it is harder for people to see and control. Treat any tool that fingerprints devices as needing consent, and be sceptical of vendors that sell "cookieless" tracking as a way to avoid asking.

Tracking pixels in emails

Open-tracking pixels in marketing emails read information from the recipient's device, and the ICO's guidance treats them as falling within the same rules. Explain open tracking when people sign up, and check your email platform's settings for disabling it for people who have not agreed.