SiteAud!tLint Support

Critical Tracking & Analytics

Tracking before consent

Severity
Critical
Impact
High
Effort to fix
Medium
Issue code
track_fires_before_consent

Why it matters

The page has a consent banner, but a first-time visitor who has not accepted anything is already tracked: pixels fire or tracking cookies are set. That is what consent rules (GDPR, UK GDPR, ePrivacy) are meant to prevent. GA4 pings sent with Consent Mode denied are not counted here.

How to fix it

Load these tags only after consent: use the consent tool's GTM integration or Consent Mode, set tags to require ad_storage / analytics_storage, and remove hard-coded pixels.

What this means

The page has a consent tool, but when SiteAud!tLint loaded it in a fresh browser without clicking anything, analytics or advertising tags still sent data or set cookies. The evidence lists what happened, for example Meta Pixel PageView; cookie _fbp (Meta Pixel).

This check needs Render JavaScript on in Crawl settings. GA4 hits sent with Google Consent Mode set to denied are allowed and not flagged, because they set no cookies.

Why it matters

A consent banner only protects you if tags actually wait for the visitor's choice. Tracking that fires before consent is a common finding in regulator and privacy complaints in regions that require prior consent, and it means your banner gives visitors a choice that is not respected. This page is not legal advice.

Common causes

  • Hard-coded tags in the theme that load regardless of the banner. See Marketing tag hard-coded outside GTM.
  • GTM tags without consent settings, firing on "All Pages" before the consent tool has loaded.
  • The consent tool loading late, after other tags.
  • Platform integrations that do not read the consent tool's choices.
  • Consent Mode defaults not set, or set to "granted".

How to fix it

  1. Load the consent tool first, before any tracking.
  2. In GTM, set each tag's consent requirements, or use triggers that wait for the consent event.
  3. Move hard-coded tags into GTM, or configure them through the consent tool's script blocking.
  4. Set Google Consent Mode defaults to "denied" where consent is required.

Verify the fix

Recrawl with rendering on. Then test yourself in a private window with the browser's developer tools open: no tracking requests or cookies should appear until you accept. See Consent checks.

How it affects your score

Tracking issues have their own Tracking score and never lower the SEO site health score. They still appear in the Action Plan, the issues CSV, Slack messages and Linear tickets. Blocks indexing, breaks pages or loses traffic. Fix these first.

Find the affected URLs

Open Crawl > Issues and pick Tracking before consent. Each affected URL is listed with its evidence, and Copy URLs or Export URLs hands the list to a developer. The issue also appears in the Action Plan, ranked by impact (high) and effort (medium), and in the issues CSV under the code track_fires_before_consent. After fixing, run a new audit and use Compare to confirm the URLs moved to fixed.

Guides that cover this issue