In one paragraph
Analytics without cookie consent means this homepage check recognised tracking-related evidence without the consent-tooling signals it expects. Verify actual storage, access, transmission, jurisdiction, and user choice before reaching a legal conclusion. Non-exempt terminal storage or access needs prior consent under the applicable ePrivacy implementation, while personal-data processing requires its own lawful basis and transparency. A script match alone cannot settle either assessment.
Why it matters
The device-storage rules and GDPR processing requirements are related but distinct. Calling technology first-party, cookieless, or server-side does not automatically establish an exemption or remove personal-data obligations. Evaluate what it actually does and why.
Google's advanced Consent Mode can load tags and send measurements without cookies while consent is denied. Basic mode blocks relevant tags until the appropriate interaction and grant under its design. These product modes are technical configurations, not automatic legal approvals for every deployment.
Installing a CMP is not the whole repair. A custom compliant mechanism may be missed, while a recognisable vendor script or an OK-only notice can satisfy a presence detector without providing valid choice or blocking.
How WebAuditOS evaluates this finding
The supplied homepage rule classifies known tracking scripts, tag-manager containers, consent-platform URLs, and captured rendered evidence. Definite tracking without expected tooling can fail at medium severity under its documented conditions; detected tooling or no recognised tracking can pass.
Container-only, consent-looking but unrendered code, unreadable overlays, and unavailable homepage cases can remain ungraded. Known lists and observation windows limit the result. Other pages and server-side processing are not comprehensively covered.
How to fix it
- Reproduce the homepage in a fresh appropriate browser context with no stored choice. Record time, URL, location assumptions, cookies, storage, and relevant requests without publishing sensitive tokens.
- Identify each technology's actual purpose and operation. Determine whether the storage or access is exempt and which personal-data processing follows, using applicable law and authority guidance rather than a vendor label alone.
- Test before interaction, rejection, acceptance by category, later visits, and withdrawal. Verify actual results rather than assuming a banner callback or a denied string stops every integration.
- Initialise consent state before dependent tags run where the chosen design requires it. Review tag-manager triggers, embedded providers, direct scripts, and custom checks separately; consent handling for Google tags does not automatically control Meta or other vendors.
- Keep privacy information and purposes accurate. Do not substitute legitimate interest for an ePrivacy consent requirement merely by changing a dashboard selection.
- If using advanced Consent Mode or another cookieless design, inspect the remaining transmitted information and obtain a context-specific assessment. Absence of analytics cookies does not prove no regulated operation or personal data remains.
- Fix or remove unnecessary technologies and retain clear evidence of configuration and review. A less invasive design can still need transparency and suitable controls.
- Rescan the technical checks and evaluate actual behaviour across representative templates and user states. Never present this pass as GDPR certification or this failure as conclusive proof of an unlawful deployment.
What the fix can break
Turning off tags can alter measurement and attribution. Treat that as an operational consequence, not a reason to retain collection without the required basis.
A blanket script block can break necessary functionality; categorise by actual purpose rather than exempting every vendor branded functional.
Do not delete logs or conceal requests merely to improve the scan result. Repair the real processing and retain appropriate accountability records.
Questions
Does loading Google Analytics prove cookies were set?
No. Inspect actual behaviour, including the configured consent mode and storage state.
Does cookieless mean automatically lawful?
No. Device access, transmitted information, GDPR duties, and national rules need assessment.
Does finding a CMP prove valid consent?
No. Presence and effective lawful configuration are different.
Which related checks help?
Review banner detection, pre-choice requests, and the cookie consent guide.