Why is my cookie scanner still reporting tracking without consent?
Your cookie scanner continues reporting tracking activities without explicit user consent, despite Consent Mode implementation. This is a common technical challenge. The root cause typically involves misconfigurations in your Consent Management Platform (CMP) or incorrect Consent Mode setup, preventing proper signal transmission to Google services. Consequently, analytics and advertising tags may fire before consent states are evaluated. Rectifying this requires a precise review of your Consent Mode v2 implementation and CMP integration. For further technical insights, consult our extensive FAQ knowledge base.
Technical Background
Google Consent Mode v2 operates by adjusting the behavior of Google tags based on user consent choices. Specifically, it introduces two additional parameters: ad_user_data and ad_personalization, alongside the existing analytics_storage and ad_storage. When a user declines consent for specific categories, Consent Mode signals this state to Google. Therefore, tags like Google Analytics 4 (GA4) and Google Ads adjust their data collection methods. For instance, if ad_storage is denied, Google tags send cookieless pings instead of full cookies. These pings contain aggregated, non-identifying data. However, if the Consent Mode signal is not correctly received or interpreted by the Google tag, the tag may default to its standard behavior, potentially setting cookies or collecting data before consent is established. This often occurs when the gtag('consent', 'update', ...) command executes too late in the page load sequence, after initial tag firing. The default consent state, if not explicitly set, is usually ‘denied’ for all parameters.
Root Causes and Diagnosis
Several technical issues can lead to persistent cookie scanner reports of unauthorized tracking. First, an incorrect default consent state is a frequent cause. If your Consent Management Platform (CMP) does not establish a ‘denied’ default state for all relevant parameters before any Google tags load, these tags may fire with full functionality. Specifically, verify the gtag('consent', 'default', ...) command executes at the absolute top of your <head> section. Secondly, the consent update command, gtag('consent', 'update', ...), might be delayed. This update must occur immediately after the user interacts with the CMP banner. Consequently, if the update is asynchronous or placed too low in the DOM, tags might have already executed based on the initial default state. Thirdly, some cookie scanners may misinterpret cookieless pings sent by Consent Mode as full tracking cookies. These pings are designed for conversion modeling and do not store user-identifiable information. Finally, an outdated or improperly configured CMP can fail to integrate with Consent Mode v2 correctly. Review your CMP’s console for any errors related to Google tag integration. For detailed setup guidelines, refer to the official Google Consent Mode documentation.
Solution
Addressing persistent cookie scanner reports requires a systematic approach to your Consent Mode implementation. First, ensure your CMP correctly initializes Consent Mode v2 with a ‘denied’ default state for all relevant parameters (ad_storage, analytics_storage, ad_user_data, ad_personalization). This code must be the very first script in your <head> section, preceding any Google tags or the Google Tag Manager container. Therefore, no Google tag can fire before this initial consent state is established. Secondly, verify that your CMP’s consent update mechanism triggers the gtag('consent', 'update', ...) command immediately upon user interaction. This command should reflect the user’s choices accurately. Additionally, confirm your Google tags are configured to respect Consent Mode. In Google Tag Manager, ensure “Enable Consent Overview” is active and that tags have appropriate consent settings. For instance, GA4 configuration tags should require analytics_storage. Finally, test your implementation thoroughly using Google Tag Assistant and your cookie scanner. Observe the network requests and console output to confirm consent states are being passed and tags are adjusting behavior as expected.
Always place your
gtag('consent', 'default', ...)command directly after the opening<head>tag and before any other scripts, including Google Tag Manager. This ensures the default consent state is established before any Google services load.
Conclusion
Persistent cookie scanner reports often stem from technical misconfigurations in Consent Mode v2 implementation, particularly regarding default consent states and timely updates. A precise setup ensures Google tags respect user consent from the outset. Therefore, rigorous testing and adherence to Google’s guidelines are critical for compliance. Consider our Consent Mode consulting services for expert assistance. We also offer comprehensive SEO optimization to improve your digital presence.
Need personal advice?
Our Google-certified experts are happy to help – free and without obligation.
Book a meeting
Free GDPR Compliance Check
We review your consent management and tracking setup for GDPR compliance – free and without obligation.
Check your compliance