Does my site fire trackers before consent?
Paste your URL and we'll tell you — by loading the page the way a first-time visitor sees it, before your cookie banner has been touched, and listing every third-party request, cookie and browser-storage key it sets.
How to check this yourself, in two minutes
- Open an incognito/private browser window (a fresh session, no prior consent).
- Open dev tools → Network tab, then load your homepage.
- Before clicking anything on the cookie banner, sort the requests by domain and look for anything that isn't yours: analytics, ad pixels, tag managers, embedded widgets.
- Repeat with the banner's Reject All button clicked and the page reloaded — compare the two lists.
Our free scan automates exactly this across the request list, cookies and storage keys, and adds a check for the Global Privacy Control (GPC) browser signal, which the manual version above doesn't cover.
Questions
- How can I tell if my site fires trackers before consent?
- Open a private/incognito browser window, open the network tab in dev tools, and load your homepage without clicking anything on the cookie banner. Every request to a domain that isn't yours, in that window, is a tracker firing before consent. Our free scan does the same thing automatically and lists them.
- Why does 'before consent' matter specifically?
- A visitor who hasn't interacted with your banner yet hasn't agreed to anything. If analytics, advertising or session-replay scripts are already running at that point, the banner isn't gating them — it's decorative. This is also the exact moment most cookie-consent rules are written around.
- What counts as a 'third-party' request?
- Any request to a domain other than the one the visitor typed in — an analytics collector, an ad network's pixel, a tag manager's own script, a font or widget hosted elsewhere. First-party requests to your own domain aren't flagged the same way, even if your own servers later forward that data somewhere.
- My tag manager says it respects consent. Why would it still fire?
- Consent mode in a tag manager only works if every tag inside it is actually configured to wait for a signal, and if nothing outside the tag manager (a script pasted directly into the page, a plugin, a third-party embed) bypasses it entirely. The only way to know for certain is to watch the actual network traffic, which is what a scan does.
Sasquatch Privacy provides technical privacy observations and is not legal advice.