1 finding · 4 warnings · 4 checks passed
Vendors
0d0b98f8-38a7-11e8-9ace-5254008f7bf1101655794416939746627815106087961633372G-4RWZL270B7G-EBJ1DYMH5TGTM-WW7D6K29503734839343350497292614294710699CRTSU6JC77UF6LFLVD1GViolations
GCM_002Do not write analytics or advertising cookies until the visitor has made a consent choice. Load GTM/GA4 tags behind a denied consent default and let the CMP's update unblock them.
GCM_008Affected: broken
Call gtag('consent', 'update') immediately after the visitor's choice, with the correct values for both accept and reject. Do not rely on a page reload: it creates duplicate pageviews and breaks session attribution.
GCM_010Affected: Exponea, Google Ads, Google Analytics 4, Hotjar, Meta Pixel, Pinterest Tag, TikTok Pixel
After a rejection the affected vendors must stop setting identifiers and sending measurement, or run only in a verified cookie-less mode.
GCM_001Call gtag('consent', 'default') with denied values before GTM or GA4 loads, so the initial consent state is explicit.
GCM_003Make both the accept and the reject button update the consent state through the GTM Consent API or gtag('consent', 'update').
GCM_009Affected: Exponea, Google Ads, Google Analytics 4, Hotjar, Meta Pixel, Pinterest Tag, TikTok Pixel
The affected vendors set an identifier or sent measurement that is not verifiably cookie-less before the visitor chose. Load them only after consent, or configure a documented cookie-less mode that sends no identifiers.
GCM_012Affected: Microsoft Clarity
No identifier was observed, but the visitor's IP address and page context still reached a third party before consent. To be compliant under this check, load the vendor only after consent.