Privacy finding
A vendor reads the device before it asks the consent tool, or while it knows EU law applies
Privacy Error Severity: High
Part of the audit The consent signal says denied, the tags behave as granted. Finding id: privacy.vendorSkipsConsentCheck.
What it costs you
The vendor's own code shows the order of events: the device was read first and consent was asked later, or never.
What to do
Load this vendor only after consent, and raise the order of calls with the vendor.
What it checks
- Vendor reads device before consent check
- GDPR flag set but device data read
How to fix it
Fix
How to verify by hand
The call stacks of the device read and of the vendor's first consent API call.
What this relies on
A vendor in a consent framework checks the consent state before it touches the device.