Severity: HighOwner: CMP adminTime to fix: 30-90 min
Marketing cookies before consent
Block ad-tech and remarketing cookies until the visitor has actively accepted marketing processing.
Covers: pre_consent_marketing_cookie, marketing_cookie_before_consent
Why this matters
Marketing cookies create a high-risk consent issue because they often enable cross-site profiling, ad attribution, and audience sync before any valid user choice exists.
How to verify manually
- Open the site in a private session without interacting with the banner.
- Check for advertising, remarketing, or social tracking cookies in browser storage.
- Look for ad-tech requests from Meta, Google Ads, TikTok, LinkedIn, Criteo, or similar vendors.
Typical root causes
- Marketing tags run on all page views regardless of consent.
- Third-party embeds initialize ad tech cookies automatically.
- CMP categories are mapped incorrectly or not enforced on the first page load.
GTM fix
- Put all marketing tags behind marketing consent signals.
- Remove fallback triggers that allow marketing tags to run in parallel.
- Retest after publish with GTM preview and a clean browser profile.
WordPress fix
- Review ad, social, and conversion plugins for automatic cookie setting.
- Block marketing categories in your CMP before any plugin initializes.
- Remove duplicate tracking injected by theme templates or page builders.
Generic fix
- Delay marketing libraries and pixels until marketing consent is granted.
- Separate marketing consent from analytics and functional categories.
- Audit all templates for direct ad-tech snippets that bypass CMP logic.
How to confirm the fix worked
- Confirm no marketing cookies are set before consent.
- Confirm marketing requests start only after Accept.
- Run a fresh scan and verify the marketing-cookie finding clears.
Next step
Re-scan after deployment to confirm that the runtime behavior changed, not just the banner copy.