Privacy finding
The consent signal says denied and requests still carry identifiers
Privacy Error Severity: High
Part of the audit The consent signal says denied, the tags behave as granted. Finding id: privacy.consentSignalVsTags.
What it costs you
The site signals 'denied' and the tag behaves as if consent was given, so identifiers leave the browser without consent. Reports in the ad or analytics platform look normal, which hides it.
What to do
Set a default of denied before any tag loads, and make each tag read the signal.
What it checks
- Consent denied but identifiers still sent
- No default consent state before tags load
How to fix it
Set the default before the tags load
- Set the consent defaults in a tag that fires on the "Consent Initialization - All Pages" trigger, so that they are in place before any other trigger fires.
- Check that the consent tool sends an update only after the visitor chose.
How to check: Run this rule again: a default consent state is seen before any Google tag loads.
Set the default before the tags load
- Set the default consent state before the code that loads the tags. For Google tags that is a gtag('consent', 'default', ...) call before any command that sends measurement data.
How to check: Run this rule again: a default consent state is seen before any Google tag loads.
Make the tag wait for the signal
A real case
France's data protection authority found that when visitors to shein.com clicked Refuse all, or withdrew their consent, new cookies were still placed and cookies already there were still read. In September 2025 it fined the company 150 million euros.
How to verify by hand
The ad or analytics platform's consent diagnostics.
What this relies on
The signal reflects the visitor's choice; the tag is misconfigured.