Severity: HighOwner: CMP adminTime to fix: 30-90 min
Analytics before consent
Stop analytics tools from loading or setting storage before the visitor has explicitly opted in.
Covers: pre_consent_analytics_cookie, analytics_before_consent
Why this matters
Analytics traffic may feel lower risk than marketing, but it is still non-essential processing and usually requires prior consent under ePrivacy rules.
How to verify manually
- Open the site in a clean session and avoid interacting with the banner.
- Look for GA4, Google Analytics, Plausible, Matomo, Adobe, or similar requests before consent.
- Inspect whether analytics cookies appear before the user clicks Accept.
Typical root causes
- Analytics tags fire on page load without consent checks.
- A legacy analytics snippet still exists outside GTM or CMP control.
- The CMP classifies analytics as functional or essential by mistake.
GTM fix
- Apply consent checks to all analytics tags and triggers.
- Remove page-view triggers that ignore consent state.
- Use preview mode to verify no analytics tag fires before opt-in.
WordPress fix
- Review theme, SEO, and analytics plugins for auto-injected tracking snippets.
- Use CMP blocking for analytics categories and disable overlapping plugins where needed.
- Clear cache and re-test from a clean browser profile.
Generic fix
- Load analytics libraries only after consent is granted.
- Treat analytics cookies as optional storage unless you have a clearly documented essential basis.
- Keep analytics initialization in one central place to avoid duplicate loaders.
How to confirm the fix worked
- Confirm analytics requests do not fire before Accept.
- Confirm analytics cookies are absent before consent.
- Run a fresh scan and verify the analytics finding is gone.
Next step
Re-scan after deployment to confirm that the runtime behavior changed, not just the banner copy.