Introduction
Stop GA4 from firing before user consent. Diagnose script ordering, GTM triggers, and Consent Mode configuration to clear this scanner finding.
What it means
Google Analytics (GA4) or gtag.js is loading and sending measurement requests before the user has made any consent choice. Scanners detect googletagmanager.com and google-analytics.com requests in the pre-consent window.
This is the single most common compliance finding across all website categories. It indicates that analytics tags load unconditionally without waiting for consent.
Why it matters
Regulators and compliance scanners treat this issue as a technical indicator that consent processes may not match stated policies. It is one of the most common findings in automated GDPR audits across all website categories.
Fixing this issue typically produces the largest single improvement in compliance scores, because it addresses the most heavily weighted scanning criteria.
Common mistakes
- Assuming the banner UI alone is sufficient — scanner findings are based on network and script behavior, not visual inspection.
- Testing only with an already-consented browser session, which hides the pre-consent behavior.
- Fixing the homepage but not campaign landing pages, subdomains, or localized variants.
Practical checklist
- Place the consent guard script before GTM/gtag in the HTML head — it must be the first synchronous script.
- Set Consent Mode v2 defaults to denied for all four parameters before any Google tag loads.
- Replace GTM All Pages triggers with consent-aware triggers for GA4 tags. Block GA4 until analytics consent is granted.
- In a private window, filter the Network tab for google-analytics.com and googletagmanager.com — zero requests before consent.
- Run a compliance scan after fixes to confirm the issue is resolved.
- Document the fix date and rescan result for audit evidence.
How GDPRChecker helps
GDPRChecker flags Google Analytics before consent as a high-severity finding in scan reports. The scanner loads your page as a first-time EU visitor and reports the specific network request, script source, or missing element that triggered the finding.
After implementing the fix, rescan your site with GDPRChecker to confirm the finding is cleared and your compliance score improves.