Why trackers still fire before consent, and how to stop them
The CIPA problem, how tag managers hide the source, and what auto-blocking actually does.
Updated
Key takeaways
- A cookie banner blocks nothing by itself. Hard-coded pixels, tag manager tags and plugin pixels usually fire before the visitor clicks.
- In California, tracking without consent has fueled lawsuits under the Invasion of Privacy Act (CIPA), at $5,000 per violation.
- A five-minute network-tab check shows the problem. The fix is consent-aware tag triggers, Consent Mode and auto-blocking.
Why trackers fire before the visitor chooses
- Hard-coded scripts in the site header run before any banner code.
- Tag manager triggers on All Pages fire as soon as the container loads.
- Platform integrations: store apps and WordPress plugins inject their own pixels.
- Embeds: video, maps, chat and review widgets call home when they render.
- Load order: a banner that loads after other scripts can't stop what already ran.
How tag managers hide the source
A tag manager loads one container, then inserts the Meta, TikTok and LinkedIn tags at runtime. A scanner that reads HTML reports the site clean, and blocking the container blocks the allowed tags too.
Google Tag Manager supports consent settings on each tag (opens in a new tab), but they only work on tags someone configured.
The legal exposure
In Europe
Under the ePrivacy Directive and the GDPR, a tracker that fires first is unlawful even under a perfect banner; see GDPR cookie consent.
In California
CIPA, written for phone wiretaps, reaches websites through Penal Code section 631 (opens in a new tab) for chat and session replay, and section 638.51 (opens in a new tab) for pixels that collect identifying information. Section 637.2 (opens in a new tab) allows $5,000 per violation without proof of harm.
SB 690, signed September 30, 2026, leaves 638.51 tracking claims to the Attorney General from January 1, 2027; 631 claims are unaffected. Under both, the defense is consent before tracking starts.
Under U.S. privacy laws
The CCPA requires honoring Global Privacy Control (opens in a new tab) opt-outs; Sephora's 2022 $1.2 million settlement (opens in a new tab) was partly over ignoring them. See our CCPA page.
Check your own site in five minutes
- Open the site in a private window with the Network tab open, and don't click the banner.
- Filter for tracker hosts such as facebook.com/tr, google-analytics.com and doubleclick.net. Any hit is a tracker firing before consent, and the initiator column shows which script sent it.
- Check the Application tab for cookies such as _ga, _fbp and _ttp.
- Click Reject all, reload and repeat: nothing marketing-related should appear.
- If you serve Europe, repeat through an EU VPN.
What auto-blocking actually does
Auto-blocking loads before your other scripts, recognizes known trackers by where they load from, holds them until their category is accepted, and sends Google Consent Mode (opens in a new tab) signals. It must load first, may need manual rules for obscure trackers, and can't see server-side tagging.
The ComplyMo cookie manager pairs auto-blocking with Consent Mode v2 and a region-aware banner, and flags trackers firing without consent.
A fix list, in order
- Load the consent script first, at the top of the head.
- Remove hard-coded pixels, or let auto-blocking hold them.
- Add consent requirements to every tag, starting with ads and session replay.
- Turn on Consent Mode v2, and re-test after every change.
Start a free trial to watch every site for trackers firing early.
General information, not legal advice. Confirm your obligations with counsel.