Google Analytics or Meta Pixel before consent: how to investigate

Use a fresh browser profile with no prior choice. Record the page, region, browser settings, time, and observation window. Open the Network and storage panels before loading the page. Preserve the request log across redirects; do not click the banner during this baseline.

Record blocked third-party storage as a coverage condition. A browser that blocks cookies can still show network requests, and an empty cookie list does not establish an absence of tracking.

For each relevant event, record its start time, destination host, initiator chain, request category, and any observed cookie or storage write. Redact identifier values and personal data before sharing the evidence.

For Google Analytics, inspect measurement requests as well as the tag loader. For Meta Pixel, inspect the pixel event requests as well as the script. Determine whether a tag manager, hard-coded script, plugin, or embedded service initiated each request; avoid guessing from a cookie name.

Google distinguishes basic consent mode, where tags are blocked until consent, from advanced consent mode, which can send cookieless pings with consent denied. A Google request before acceptance is therefore not, by itself, evidence of a consent-mode failure.

Inspect the actual consent state, payload, storage behavior, and intended implementation. Check that defaults are applied before relevant tags execute and that later choice updates reach the tags.

Primary sources:Google consent mode overviewGoogle consent implementation guide

Give the tag owner the initiator chain and event timing. Review initialization order, consent categories, tag triggers, duplicate installations, plugin integrations, and tags loaded outside the CMP-controlled path.

Treat Meta and other vendor implementations individually. Google consent-mode behavior does not automatically describe how a different vendor handles consent. Confirm the actual integration settings and retained requests.

Use independent fresh sessions for each path. For action tests, record a completed click separately from confirmed consent registration and completed observation. Preserve requests that began before the choice so they are not mistaken for newly initiated post-choice activity.

A cookie left in storage is not by itself proof of continued use. Look for direct eligible requests or new writes. A failed or partial capture stays inconclusive.

Include the affected page and environment; request destination and initiator; consent state; timing; storage evidence with values redacted; intended behavior; and the responsible tag or CMP owner. After the fix, compare the same conditions and retain the new evidence.

CertScore.ai can supply public-page request, cookie, vendor, and consent observations for this review. Internal tag configuration, server-side processing, legal basis, and all visitor journeys require separate review.