Introduction
Fix marketing and analytics trackers that fire before user consent. Identify all unauthorized third-party requests and block them until opt-in.
What it means
Third-party tracker scripts — marketing pixels, analytics tags, social widgets, or session recording tools — are firing network requests before the user has made any consent choice.
Each unauthorized request represents personal data being sent to a third party without a valid legal basis. This is the finding regulators most consistently penalize in enforcement actions.
Why it matters
Regulators and compliance scanners treat this issue as a technical indicator that consent processes may not match stated policies. It is one of the most common findings in automated GDPR audits across all website categories.
Fixing this issue typically produces the largest single improvement in compliance scores, because it addresses the most heavily weighted scanning criteria.
Common mistakes
- Assuming the banner UI alone is sufficient — scanner findings are based on network and script behavior, not visual inspection.
- Testing only with an already-consented browser session, which hides the pre-consent behavior.
- Fixing the homepage but not campaign landing pages, subdomains, or localized variants.
Practical checklist
- Inventory every third-party script on your site — GTM, analytics, pixels, chat widgets, social embeds.
- Classify each as strictly necessary or consent-required. Block all consent-required scripts until the matching category is granted.
- Place the CMP or runtime guard before all third-party scripts in the HTML head. Verify with View Source.
- Test in a private window with the Network tab open: zero non-essential third-party requests before banner interaction.
- Run a compliance scan after fixes to confirm the issue is resolved.
- Document the fix date and rescan result for audit evidence.
How GDPRChecker helps
GDPRChecker flags trackers firing before consent as a high-severity finding in scan reports. The scanner loads your page as a first-time EU visitor and reports the specific network request, script source, or missing element that triggered the finding.
After implementing the fix, rescan your site with GDPRChecker to confirm the finding is cleared and your compliance score improves.