Privacy finding
The consent string records no consent for a vendor and the page calls that vendor
Privacy Error Severity: High
Part of the audit The consent signal says denied, the tags behave as granted. Finding id: privacy.consentStringVsVendorCalls.
What it costs you
The record the site keeps of the visitor's choice says no, and the request goes out anyway. The record and the behaviour can be put side by side by anyone.
What to do
Make the tag that calls the vendor wait for the consent the string records.
What it checks
- Consent string says no but vendor called
How to fix it
Make the vendor's tag follow the string
- Find what sends the request in the evidence: a tag in the tag manager, a script in the template, or another vendor's script.
- Hold it back until the consent tool reports consent for [vendor], or remove it.
- If another vendor's script loads it, that script needs the same condition.
How to check: Reject in a private window and reload: the network panel shows no request to [vendor]. Then run this rule again.
A real case
France's data protection authority found that when visitors to shein.com clicked Refuse all, or withdrew their consent, new cookies were still placed and cookies already there were still read. In September 2025 it fined the company 150 million euros.
How to verify by hand
The consent platform's vendor list and the tag that calls the vendor.
What this relies on
The string is right; a tag does not read it.