Tracking Requests Before Cookie Consent: Inspect the Actual Transmission

In one paragraph

Tracking requests before cookie consent means a fresh-load request hostname matched the detector's vendor list before the scanner made a choice. Verify the actual endpoint, information, device operation, and applicable legal basis rather than treating a hostname as a final verdict. Container loads and declared denied-state pings are weaker categories in this rule, not automatic legal exemptions or evidence that no data was transmitted.

Why it matters

Tracking can involve device access or information transmission without a conventional analytics cookie. The EDPB's final Guidelines 2/2023 explain technical scope with examples including pixels and tracking links; applying the rule still requires examining the operation and relevant exemptions.

A request can reveal network metadata and, depending on headers and payload, contextual information. It does not necessarily transmit the full page URL in every case. Referrer policy, implementation, and request content matter.

Google Consent Mode signals adjust tag behaviour, but a particular query parameter is not a complete audit of all current consent states or vendor processing. Default-denied technical behaviour does not itself establish lawful deployment, and a tag-manager container is not equivalent to every possible analytics action inside it.

How WebAuditOS evaluates this finding

The supplied rule records request hosts during its fresh mobile settle window and matches a curated list using hostname boundaries. Known non-excepted hosts fail at high severity; only contested container hosts or its recognised denied-ping category warn. No recognised host passes, and missing snapshots can be ungraded.

Its documented legacy gcs=G100 treatment is a narrow classifier, not full Consent Mode validation. Unknown hosts, first-party proxies, backend traffic, and later interactions fall outside the list or window. The count does not by itself verify payload, legal purpose, or effective user choice.

How to fix it

1. Reproduce the fresh initial visit and record the actual requests and timing. Use safe test data and avoid publicly sharing URLs or bodies containing identifiers, tokens, or sensitive page context.
2. Distinguish a container or library download from an event submission, storage operation, or backend forwarding. Follow initiators and configuration rather than assuming one domain proves the entire flow.
3. Assess the device access and any personal-data processing under their respective rules. Do not assert that absence of cookies universally removes ePrivacy or GDPR obligations.
4. Initialise and enforce the reviewed consent design before relevant operations run. Test direct integrations, tag-manager templates, provider frames, and custom event code separately.
5. Inspect all meaningful consent signals and actual behaviour where a vendor uses such a mode. A recognised denied flag on one request does not validate another vendor or the rest of the page.
6. Test refusal, category grants, withdrawal, return visits, delayed loading, and important user interactions. A short initial network snapshot cannot validate the whole lifecycle.
7. Review first-party and server-side routes as well. Proxying a measurement endpoint can remove a vendor-host match while leaving the same relevant operation intact.
8. Rescan and document what was actually observed, what remains uncertain, and the applicable contextual review. Do not present a downgraded warning as approval or a host match alone as a proven offence.

What the fix can break

Blocking every external request can prevent essential content or a requested service. Classify purpose and operation rather than relying on domain popularity.

A provider setting can alter collection without updating another integration's defaults. Keep the implementation and notice aligned.

Do not bypass the detector by changing hostnames, timing, or parameter spelling. Repair the actual processing and choice behaviour.

Questions

Is a Tag Manager load proof an analytics event was sent?

No. Inspect what the container and downstream code actually do.

Does gcs=G100 prove the whole site is compliant?

No. It is a limited technical signal in this classifier, not a complete legal or vendor-state assessment.

Are first-party proxies automatically exempt?

No. The operation and applicable rules remain relevant even when the detector cannot attribute the host.

Which related checks help?

Review cookie timing, banner evidence, and the cookie consent guide.