Every week we look at a site that has a cookie banner, a privacy policy and a proud "GDPR compliant" badge in the footer. Then we open the browser's developer tools and watch Google Analytics fire before anyone has clicked anything. The banner is decoration. The tracking never waited for the answer.
This isn't a legal article and I'm not a lawyer. It's the practical check we run on every site before it goes live, written so you can run it yourself.
Why the banner alone doesn't count
Under GDPR and Spain's LSSI, analytics and marketing cookies need consent before they're set. Not after, not "implied by scrolling". A banner that appears while GA4 is already loading has asked a question after acting on the answer.
The usual reason is simple: the banner was added as a plugin, the tags were added to Google Tag Manager, and nobody connected the two. GTM fires on page load unless you tell it to wait.
The two-minute check
- Open your site in an incognito window, so no earlier consent is remembered.
- Press
F12(orCmd+Option+Ion a Mac) and open the Network tab. - In the filter box, type
google. - Reload the page. Do not touch the banner.
- Look at the list.
If you see requests to google-analytics.com or googletagmanager.com/gtag before you've clicked anything, you're tracking without consent. That's the whole test. Everything below is about fixing it.
The fix, in Tag Manager
Two things need to be true. First, GTM has to know what the visitor chose. Second, every tag has to be told to wait for that.
1. Set a consent default, before anything else
Google's Consent Mode v2 expects a default state on every page, set before the GTM container loads. Denied everything, then update when the person answers:
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('consent', 'default', {
analytics_storage: 'denied',
ad_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
wait_for_update: 500
});
Your banner then calls gtag('consent','update', …) with 'granted' for whatever the person accepted. Most decent consent tools do this for you once you turn on the Google integration. Check that it's on.
2. Gate the tags
In GTM, open each tag, expand Consent settings, and add the consent type it needs: analytics_storage for GA4, ad_storage for ads and pixels. Tags with a requirement won't fire until it's granted.
3. Delete the noscript iframe
The GTM install snippet comes in two parts. The second one is a <noscript><iframe> block in the body, and it cannot be consent-gated. It loads the container for anyone with JavaScript off, which today means almost nobody but some bots. Remove it. Nothing you care about breaks.
Then run the check again. Incognito, Network tab, filter "google", reload, don't click. The list should be empty until you accept. If it isn't, something is still firing outside GTM: a plugin, a theme setting, a hardcoded script. Find it and route it through GTM or remove it.
What WordPress plugins get wrong
- Pre-ticked boxes. Consent has to be an action. A pre-checked "I agree" is not consent, and neither is a banner with only an "Accept" button.
- "Reject" hidden two clicks deep. Rejecting must be as easy as accepting. Same screen, same weight.
- Banner blocks, but the theme doesn't. Themes that embed YouTube, Google Maps or fonts from Google load those directly. The banner never sees them.
Before go-live checklist
- Consent default is set to denied, before the GTM snippet
- Every GA4, Ads and pixel tag has a consent requirement in GTM
- The noscript iframe is deleted from the template
- Incognito Network test: nothing to Google before accepting
- Reject is one click, on the same screen as Accept
- Cookie policy lists what actually runs, not a template list
If you remember one thing
- The banner is the question. GTM's consent settings are the answer. Both have to exist.
- The Network tab doesn't lie. Test it before go-live and after every plugin update.
- Delete the noscript iframe. It's the most common leak we find.
If you'd rather someone else ran this, it's part of every website we build and something we can do on an existing site as a fixed-price job. Book the call and we'll tell you what we found before you pay anything.
Builds websites and the systems behind them for small businesses in Spain and the Netherlands. Writes down the things clients ask twice.
