Tracking and Consent: Load Analytics Only After Opt-In
Analytics, advertising pixels and session recorders usually set cookies or read identifiers from the visitor’s browser as soon as their script loads. In the European Union, the United Kingdom and Turkey, among others, the rules on personal data and on accessing a visitor’s device generally require the visitor’s consent before non-essential tracking of this kind starts.
This guide explains the technical side. It is not legal advice: what your site needs depends on where you operate, who your visitors are and what you collect, so confirm the details with a qualified adviser.
The rules in brief
- ePrivacy. The EU’s ePrivacy Directive (Article 5(3)) requires consent before storing or reading information on a visitor’s device, unless it is strictly necessary for the service the visitor asked for. Analytics and advertising cookies are generally not strictly necessary.
- GDPR sets what valid consent looks like: freely given, specific, informed and unambiguous, given by a clear action, and as easy to withdraw as to give. Pre-ticked boxes and “by using this site you agree” banners don’t meet it.
- KVKK (Turkey’s Law No. 6698 on the Protection of Personal Data) has its own consent and notice requirements, and the Turkish Personal Data Protection Authority has published guidance on cookies.
In practice this means that tracking tags should not run until the visitor agrees, and a visitor who declines or ignores the banner should not be tracked.
How to fix
- List your tags. Note every analytics, advertising and recording script on the site, including ones added by plugins or a tag manager.
- Add a consent management platform (CMP). Common options include Cookiebot, OneTrust, CookieYes, Usercentrics, Didomi, iubenda and, on WordPress, Complianz or Borlabs Cookie. Configure it to block non-essential scripts until consent. Many CMPs can scan your site and block known tags automatically; check the result yourself.
- Hold tags back in the tag manager. In Google Tag Manager, fire tracking tags only on a consent trigger or use its consent settings, so nothing runs before the CMP reports a choice.
- Set Google Consent Mode defaults to denied if you use Google tags. The default must run before any Google tag:
gtag('consent', 'default', {
ad_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
analytics_storage: 'denied',
});
Your CMP then sends gtag('consent', 'update', { ... }) with the visitor’s choice. Most certified
CMPs do this for you. See Google’s
Consent Mode documentation.
In Consent Mode’s “advanced” setup, Google tags still load before consent and send cookieless
signals; whether that suits your obligations is a question for your adviser.
- Test as a new visitor. Open the site in a private window, refuse consent and look at the browser’s network panel and cookie storage. No tracking requests or cookies should appear.
How PerfoMetrix checks this
We read the page’s HTML exactly as your server first sent it to our scanner, which never clicks a consent banner. We look at every script’s address and the start of each inline script for these tags:
- Google Analytics and Google Tag Manager
- Google Ads and AdSense
- Meta Pixel
- Microsoft Clarity and Microsoft Ads (UET)
- LinkedIn Insight, TikTok Pixel and X (Twitter) Pixel
- Hotjar
- Yandex Metrica
We also look for consent tools: Cookiebot, OneTrust, CookieYes, Usercentrics, Didomi, Quantcast
Choice, iubenda, Termly, Complianz, Borlabs Cookie, CookieFirst, Google’s Funding Choices message,
and a Google Consent Mode default command.
| What we find | Result |
|---|---|
| no tracking tags | passes |
| tracking tags and a consent tool | passes |
| tracking tags, no consent tool | needs attention |
The limits of a passive check:
- A detected consent tool doesn’t prove it works. We see that it is present, not whether it actually blocks the tags before consent. We also don’t read the values in a Consent Mode default, so set them to denied as shown above.
- Tags added later are invisible. A tag that a tag manager or CMP injects only after consent doesn’t appear in the HTML we receive, which is the intended setup, but the tag manager itself is still listed.
- Unknown tags aren’t recognised. Tracking from services not in the list above, server-side tracking and first-party cookies set by your own code are not covered. See Third-party cookies for the cookies we do see.