Part 9 of the series "EU Web Security: 10 Steps to a Better Rating"
Pre-Consent: The Real Problem
The debate around cookie banners obscures the actual risk: what happens before the user clicks anything?
We scan every website in a pre-consent state — before the banner is displayed, before the user clicks. And we regularly find:
- Google Analytics / Meta Pixel loading before consent
- Third-party cookies set before the banner appears
- Tracking scripts in
<head>that fire immediately - Data transfers to third countries (US) without a legal basis
This is not a minor infraction. CNIL (France) alone imposed over EUR 50 million in fines for pre-consent tracking in 2024. AEPD (Spain) follows suit.
What the Law Says
ePrivacy Directive Art. 5(3): Access to the user's device (setting cookies, fingerprinting) requires prior consent. Exception: strictly necessary cookies.
GDPR Art. 6(1)(a): Consent must be freely given, informed, and unambiguous — before the data processing begins.
CJEU ruling C-673/17 (Planet49): Pre-ticked checkboxes do not constitute valid consent. Opt-in, not opt-out.
Schrems II (C-311/18): Data transfers to the US require additional safeguards. A Google Analytics script that loads before consent and sends data to US servers is a Schrems II violation.
What We Check
SiteGuardian analyses website behaviour in the pre-consent state:
- Pre-consent cookies — which cookies are set before the banner appears?
- Third-party requests — which third parties are contacted before the user consents?
- Third-country transfers — does data flow to non-EU countries (particularly the US)?
- Cookie banner — does one exist? Does it offer a genuine reject option?
- Consent mechanism — are trackers actually disabled after the user rejects?
The Most Common Violations
1. Google Analytics without consent. The most common pre-consent violation in our benchmark. The GA script sits in <head> and loads immediately — the cookie banner only appears after GA has already sent data to Google.
2. Meta/Facebook Pixel. Same issue: the pixel loads first, sets _fbp and _fbc cookies, sends data to meta.com — all before consent.
3. Embedded content. YouTube videos, Google Maps, social media widgets — each loads third-party resources and sets cookies. Solution: use placeholders until consent, then load dynamically.
4. CMP configuration errors. The cookie banner is there, but the "Reject" option is hidden, greyed out, or redirects to another page. CNIL and the EDPB require that "Reject" must be as easy to use as "Accept".
How to Check Your Website
Manual (Browser DevTools)
- Open the browser in incognito/private mode
- Open DevTools > Network tab
- Load the website, do NOT click on the banner
- Network tab: which third-party requests do you see?
- Application > Cookies: which cookies are set?
Automated
SiteGuardian runs exactly this test automatically — for every domain, with a real Chromium browser, in a pre-consent state:
What You Should Do
- Put Google Analytics / Meta Pixel behind the consent manager. Only load when the user clicks "Accept".
- Use youtube-nocookie.com instead of youtube.com for embeds.
- Make the reject button equally prominent. Same size, same colour, same position.
- Verify after rejection: are the scripts actually not loading? Many CMP configurations have gaps.
- Scan regularly. A CMS update, a new plugin, a marketing tag — and suddenly pre-consent trackers are back.
Next week in Part 10: The Full Check — all dimensions at once, and how to get your score from F to C.