Cookies before consent: finding the tracker your banner missed
Why a cookie banner isn’t enough, how the AICOMBase privacy audit catches tracking that fires before the visitor clicks “Accept”, and what to do about it.
4 min read · For anyone with analytics or ads on their site · Illustrative example
The problem
Under EU rules, non-essential cookies and trackers should only load after the visitor agrees. Many sites have a cookie banner but still load an analytics or advertising script straight away, because it was added by a theme, a plugin or a copy-pasted snippet.
What the audit sees
- Cookies set before consent — measured on a fresh visit, before anything is clicked.
- Requests to known tracking services before consent.
- Tracking code in the page even when no consent tool is detected.
- Embeds (videos, maps) and fonts loaded from third parties on page load.
- Missing privacy-policy or cookie-policy links, and forms that collect personal data without a notice.
Each finding shows the evidence — the cookie name, the request URL, the page — so you can see it for yourself.
Fixing it
Often the fix is to let your consent plugin manage the script, or to switch an embed to a click-to-load version. AICOM can make supported changes inside a session; the audit then runs again to confirm the tracker no longer loads before consent.
The privacy audit reports what it observes. It is not legal advice.