Privacy finding
The banner and the tag manager hold different consent states after the same choice
Privacy Error Severity: High
Part of the audit The consent signal says denied, the tags behave as granted. Finding id: privacy.consentSignalSourcesDiffer.
What it costs you
The banner records a no and the tags are told yes. They store and send what the visitor refused.
What to do
Find where the two get out of step: a missing update from the consent tool, or a second script that sets the consent state.
What it checks
- Signal differs between tag manager and banner
How to fix it
Let one source set the consent state
- In Google Tag Manager, check that the consent tool's tag fires on the "Consent Initialization - All Pages" trigger.
- Look for a second tag or a script in the page that also sets the consent state, and remove it.
- Use preview mode to read the consent state after each choice.
How to check: Run this rule again: both sources hold the same value after each choice.
Let one source set the consent state
- Find every script that sets the consent state. There should be one: the consent tool.
- Check that the consent tool sends its update to the tag manager after each choice.
How to check: Run this rule again: both sources hold the same value after each choice.
A real case
France's data protection authority found that when visitors to shein.com clicked Refuse all, or withdrew their consent, new cookies were still placed and cookies already there were still read. In September 2025 it fined the company 150 million euros.
How to verify by hand
The tag manager's preview mode, which shows the consent state per event.
What this relies on
The banner holds the visitor's choice; the update never reaches the tag manager, or a second script overwrites it.