Tags firing before consent

A hit before consent is not automatically a fault

This is the part worth reading before anything else. Google’s Consent Mode has an advanced mode that deliberately sends cookieless measurements before a visitor makes a choice. A correctly configured advanced-mode implementation and a banner that gates nothing can both produce pre-choice traffic, and externally the two look the same.

The receipt shows that a Consent Mode signal was on the wire and what its raw value was. We do not decode that value into a granted-or-denied state, an intent, or a compliance verdict — a raw gcs value alone does not establish one, so reading the digits would be folklore rather than evidence. Which of the two cases you are looking at is a question only your GA4 and GTM configuration can answer, so the finding hands you the question rather than calling it a violation.

Why it matters anyway

A banner implies a choice. When measurement goes out before that choice is possible, the behavior your visitors get and the behavior your consent flow describes are two different things — and only one of them is written down. Pre-choice requests were sent. The scan cannot show what the destination retained or reported, which is exactly the question you are left holding.

It is also the kind of thing that changes without anyone deciding to change it: a CMP version bump, a tag added straight to the theme instead of the container, a GTM publish that widens a trigger. Whoever owns the reporting is the one who gets asked about it later, usually with no record of when it started.

How the scan probes consent

Consent is observed across two passes, each a fresh context with no prior state, so what is sent before a choice can be compared with what changes after one:

Where your tracking setup goes wrong

When the behavior isn’t intended, these are the usual sources:

• A measurement tag hardcoded in the theme, outside the container the CMP governs.
• A GTM tag on an all-pages trigger with no consent condition attached.
• Consent Mode defaults set to permit the send, or no defaults set at all.
• The CMP script loading after the measurement tag, so nothing is gated on the first load.
• An ad platform’s own snippet pasted in directly, bypassing the container entirely.
• Region-conditional CMP configuration that shows a banner in one region but gates only in another.

Seen in the wild: an anonymized report carrying this finding alongside a duplicate pageview, with the banner state and both hits on the wire.

What the scan can’t tell you yet

The scan records an observable state. It does not record an intention, and it does not reach a legal conclusion. This is where the evidence stops:

• Whether the behavior was intended by the CMP or the Consent Mode configuration — that needs the GA4/GTM configuration view.
• What the destinations retained, reported, or discarded once the hit arrived.
• Which legal framework applies to a given visitor, or whether the site complies with it. This check is not a compliance verdict.
• How the site behaves in other regions — this is one observation from our US scan region, and consent behavior is commonly region-conditional.
• What happens after rejection — the current scan does not establish that.

What the watch adds

The watch re-runs this check on a schedule, so a consent regression introduced by a CMP update, a tag added outside the container, or a GTM publish is caught the week it happens rather than at the next audit. Whether your configuration intended the behavior needs read-only GA4/GTM access; the page alone can’t show it.

See it on a site you manage: run a free scan.