Technical reference

CertScore findings reference

Findings are automated public-web observations for review. They are not legal conclusions, certifications, compliance determinations, or proof of non-compliance.

How to read a finding

Use the badges and evidence tiers together: criticality describes review priority, confidence describes evidence strength, prevalence gives directional calibration context, and regulatory context shows review lenses that may be relevant depending on jurisdiction, purpose, and manual review.

How top findings are calibrated

CertScore ranks findings using evidence strength, directness, corroboration, affected surface, and review relevance. Benchmark frequency is market context only. A rare finding is not automatically critical, and a common finding is not automatically low risk. Findings remain automated public-web observations for review, not legal conclusions.

Selected finding

Third-party tracking observed before recorded consent

HighStrong evidenceDirect observationConsent timingSeen on ~18% of scanned top sites

Directionally, this is one of the more common findings in the calibration set. It suggests that consent-timing enforcement remains a recurring implementation challenge across public websites.

Benchmark frequency is directional market context only. It is not a compliance benchmark, legal conclusion, or severity score. Rare findings may be top-ranked only when retained evidence is strong; common findings may remain medium when evidence is automated or context-dependent. Rarity is not severity, and prevalence is not compliance risk.

Observed

Why this matters

This can indicate that analytics, advertising, or profiling vendors were observed running before the site recorded a user choice. Depending on the site, region, vendor purpose, consent state, and consent design, that timing can be relevant to privacy, consent, and consumer-protection review.

Detection methodology

CertScore records a timestamped runtime sequence for the page load, including page start, consent-surface observations, detected consent state, user-choice events when observed, network requests, cookie and storage activity, vendor attribution, and scan coverage signals. This finding is surfaced when retained runtime evidence shows at least one classified non-essential request or storage artifact, including vendor attribution where available, before CertScore observed a consent action or a prior consent state associated with that purpose. CertScore does not infer this finding from the mere presence of a consent banner, CMP script, tag manager, privacy policy language, static source reference, or vendor name alone. Vendor purpose, necessity, consent state, region targeting, exemptions, and coverage reliability should be reviewed before drawing conclusions.

Confidence semantics: Strong when retained runtime evidence includes consent timing, non-essential request or storage classification, concrete runtime anchors, and usable coverage; good when a concrete pre-consent artifact is present with less complete supporting detail.

Top-finding calibrationWhat must be retained to surface, top-rank, demote, or suppress this finding.

Minimum to surface

Classified non-essential request or storage before observed consent.

High confidence requires

Usable coverage.
Purpose classification.
Runtime anchor.

Top ranking requires

Advertising, replay, identifier-sync, or sensitive-surface context.

Demote or suppress when

Tag manager only.
Strict necessity.
Blocked scan.
Unreliable timing.

These rules describe ranking calibration for already-projected findings. They do not create findings from raw signals.

Example evidence

Timeline

0msPage started
842msConsent banner visible
910msConsent State Observed: No Choice Observed
1,137msExample Tag Manager loaded — supporting context only
3,405msExample Analytics collect request fired — classified non-essential artifact

Representative runtime context

Example Tag Manager, Example Analytics

Key counts

Pre-consent tracking requests: 1
Runtime context entries: 2

Consent and request timeline

0ms page_start
842ms consent_banner_visible
910ms consent_state_observed: no_choice_observed
1,137ms https://tagmanager.example/gtm.js [supporting_context_only]
3,405ms https://analytics.example/g/collect [classified_non_essential]
consent_action_observed_before_first_signal=false
observed_prior_consent_state_for_purpose=false

Classified pre-consent runtime anchors

artifact=req_002
type=network_request
vendor=Example Analytics
purpose_category=analytics_measurement
essentiality=non_essential
timestamp_ms=3405
query_redacted=true
initiator=tagmanager.example script
artifact=storage_001
type=cookie_write
name=_ga
value_redacted=true
purpose_category=analytics_identifier
timestamp_ms=3468

Coverage and caveats

coverage_status=usable
material_block_observed=false
scan_scope=public homepage runtime
review_caveat=automated observation; review consent state, vendor purpose, regional configuration, and exemptions

View redacted sample JSON

Redacted sample JSON

{
  "findingId": "pre_consent_tracking_detected",
  "label": "Third-party tracking observed before recorded consent",
  "category": "Consent",
  "criticality": "high",
  "evidenceConfidence": "strong",
  "directVsInferred": "direct_observation",
  "evidence": {
    "summary": "Runtime evidence showed a classified non-essential tracking, analytics, advertising, cross-site measurement, or storage signal before CertScore observed a consent action or a prior consent state associated with that purpose.",
    "examples": [
      {
        "title": "Consent and request timeline",
        "lines": [
          "0ms page_start",
          "842ms consent_banner_visible",
          "910ms consent_state_observed: no_choice_observed",
          "1,137ms https://tagmanager.example/gtm.js [supporting_context_only]",
          "3,405ms https://analytics.example/g/collect [classified_non_essential]",
          "consent_action_observed_before_first_signal=false",
          "observed_prior_consent_state_for_purpose=false"
        ]
      },
      {
        "title": "Classified pre-consent runtime anchors",
        "lines": [
          "artifact=req_002",
          "type=network_request",
          "vendor=Example Analytics",
          "purpose_category=analytics_measurement",
          "essentiality=non_essential",
          "timestamp_ms=3405",
          "query_redacted=true",
          "initiator=tagmanager.example script",
          "",
          "artifact=storage_001",
          "type=cookie_write",
          "name=_ga",
          "value_redacted=true",
          "purpose_category=analytics_identifier",
          "timestamp_ms=3468"
        ]
      },
      {
        "title": "Coverage and caveats",
        "lines": [
          "coverage_status=usable",
          "material_block_observed=false",
          "scan_scope=public homepage runtime",
          "review_caveat=automated observation; review consent state, vendor purpose, regional configuration, and exemptions"
        ]
      }
    ],
    "counts": {
      "preConsentTrackingRequests": 1,
      "representativeVendorCount": 2
    },
    "representativeVendors": [
      "Example Tag Manager",
      "Example Analytics"
    ],
    "timelineEvents": [
      {
        "value": "0ms",
        "label": "Page started"
      },
      {
        "value": "842ms",
        "label": "Consent banner visible"
      },
      {
        "value": "910ms",
        "label": "Consent State Observed: No Choice Observed"
      },
      {
        "value": "1,137ms",
        "label": "Example Tag Manager loaded — supporting context only"
      },
      {
        "value": "3,405ms",
        "label": "Example Analytics collect request fired — classified non-essential artifact"
      }
    ]
  }
}

Regulatory review context

Consent timing: tracking before recorded choice

Runtime evidence showed a classified non-essential tracking, analytics, advertising, cross-site measurement, or storage signal before CertScore observed a consent action or a prior consent state associated with that purpose. This may be relevant to consent timing, cookie/tracker, storage, transparency, and user-choice review depending on jurisdiction, purpose, configuration, and exemptions.

ePrivacy Article 5(3) storage/access reviewGDPR valid consent reviewGDPR transparency and data protection by default reviewEU ePrivacy/GDPR tracking consent reviewUK PECR / ICO cookie consent reviewCCPA/CPRA sale, share, or cross-context advertising reviewMore context in reference notes

View applicability notes

Legal and regulatory frameworks

ePrivacy Article 5(3) storage/access reviewCookies, local storage, device identifiers, or similar terminal-equipment access occurs before consent or outside a recognized exemption.
GDPR valid consent reviewConsent is used as the lawful basis for personal-data processing or for cookie/device-access consent.
GDPR transparency and data protection by default reviewPersonal data, online identifiers, profiling, or third-party disclosure may be involved.

Jurisdictional contexts

EU ePrivacy/GDPR tracking consent reviewEU/EEA users, cookies, device access, analytics, advertising, or profiling may be in scope depending on purpose, consent state, jurisdictional context, and manual review.
UK PECR / ICO cookie consent reviewUK users and non-essential cookies or similar technologies may be in scope depending on purpose, consent state, jurisdictional context, and manual review.
CCPA/CPRA sale, share, or cross-context advertising reviewCalifornia users and the observed non-essential advertising, analytics, identifier-sharing, or vendor activity could be relevant to sale/share, cross-context behavioral advertising, or opt-out honoring review; pre-consent timing alone does not determine sale/share status.
FTC privacy claim reviewRuntime behavior may conflict with public statements, consent claims, or privacy representations.

This finding does not determine legal status. Review the retained runtime anchors, vendor purpose, necessity, consent state, disclosure, region targeting, CMP configuration, prior consent state, and any applicable exemptions.

Evidence standard

Strong

Consent timeline sequence with page start, consent-surface or consent-state observation, and no observed consent action before the classified runtime signal.
At least one concrete non-essential request or storage artifact with retained timing and a stable runtime anchor.
Purpose classification showing advertising, behavioral analytics, cross-site measurement, retargeting, pixel tracking, session replay, identifier syncing, or another non-essential purpose.
Coverage check showing the scan was not materially blocked or interrupted in a way that makes event order unreliable.

Good

Concrete non-essential runtime artifact before any observed consent action, with less complete supporting detail such as category-level classification or no paired storage evidence.
Known advertising, analytics, or measurement endpoint observed before consent with enough URL origin/path and timing context for reviewer inspection.

Audit-only

Contextual signals such as a CMP, banner, tag manager, vendor registry match, policy disclosure, or static script reference without a concrete pre-consent non-essential runtime artifact.
Runtime activity that appears relevant but lacks enough timing, classification, or anchor detail to support public surfacing.

Insufficient

Snapshot booleans without consent timeline support and retained runtime anchors.
Vendor names, policy text, cookie names, static source references, or tag manager load alone.
Interrupted or materially blocked scans where request order or consent state cannot be trusted.
Strictly necessary storage, security, load-balancing, fraud-prevention, or session activity without evidence of non-essential tracking purpose.

Evidence levels explain how CertScore treats retained runtime artifacts. They are not legal conclusions.

Common causes

Tag manager containers firing before consent mode is initialized
Analytics or ad pixels loaded in the document head
CMP events not connected to downstream vendor blocking

Common remediation approaches

Teams commonly review whether consent mode or CMP state is initialized before the tag manager or vendor scripts can fire.
Tag-manager triggers may need to be gated on consent-state variables rather than page-load timing alone.
CMP event listeners are often reviewed to confirm that analytics, advertising, measurement, and replay vendors are blocked until the intended consent state is available.
Clean-profile testing with the browser network panel open can help compare the first non-essential request timestamp against banner visibility and consent-state observations.
Regional CMP configuration should be tested separately where consent behavior varies by geography.

Limitations and cautions

This finding is an automated runtime risk signal for review, not a legal conclusion, certification, or compliance determination.
A consent banner, CMP script, tag manager, vendor name, policy disclosure, or cookie name is not enough by itself.
Some storage, security, fraud-prevention, load-balancing, session, or analytics activity may be necessary or exempt depending on purpose, configuration, retention, sharing, and jurisdiction.
Consent state can vary by region, browser state, prior choices, A/B tests, CMP configuration, login state, and page path.
Clean-profile scans may not reflect returning-user consent states; returning-profile scans may suppress banners because a prior preference exists.
Automated vendor and purpose classification may be incomplete or incorrect. Review retained runtime anchors before taking action.
CertScore redacts or avoids retaining full query strings, cookie values, and sensitive payloads where possible while retaining stable anchors needed for review.
Findings should be reviewed with retained evidence, implementation context, and applicable regional settings before operational or legal reliance.
Automated findings may contain errors and should be reviewed with the retained evidence.
Not detected means not observed in the scan scope; it is not proof of absence.
Findings are runtime evidence and public-surface observations for review, not legal conclusions.

Reference notes

CertScore uses findings, evidence, signals, and observations consistently: signals are raw runtime or page-surface events, evidence is retained support, observations are interpreted evidence context, and findings are promoted review items.
Findings are runtime evidence and public-surface observations for review. Observed signals may surface possible concerns, but review is recommended before operational or legal reliance.
Finding reference content is reviewed periodically and updated when material guidance changes. CertScore monitors guidance families such as EDPB consent and ePrivacy materials, ICO cookie guidance, CNIL tracker recommendations, FTC privacy and dark-pattern materials, and relevant accessibility guidance where applicable.
EDPB consent guidance is relevant to consent quality and affirmative indication where consent is relied upon.
EU ePrivacy cookie/tracker principles are relevant to storing information or gaining access to information on user terminal equipment.
ICO cookie and similar technologies guidance is relevant to active consent, clear explanation, and essential-cookie exceptions.
CNIL cookie/tracker and analytics guidance is relevant to tracker consent and limited analytics exemptions.
FTC dark-pattern and commercial-surveillance materials may be relevant to hidden tracking or unclear user-choice review, but this finding does not determine deception, unfairness, or legal status.
Prevalence labels use the Tranco top 1-2500 calibration set, an approximately 2,505-scan directional calibration set.

CertScore's finding references are reviewed periodically and updated when material regulatory or accessibility guidance changes. Guidance families monitored include EDPB consent and ePrivacy materials, ICO cookie guidance, CNIL tracker recommendations, FTC privacy and dark-pattern materials, CPRA/privacy-choice materials, and accessibility guidance where applicable.

Want to test these findings on a public website? Use the CertScore GPT to scan a public website from ChatGPT.

Results are automated public-web observations for review, not legal advice or a compliance determination.

Open CertScore GPT