Pixel Auditor/Help/Pre-consent violations

Pre-consent violations

Where they appear, why they matter, and the most common causes.

A pre-consent violation is a tracking fire that happens before consent_update grants the relevant storage type. v2.0's classifier is much more precise than 1.0's binary flag — see Consent Mode classifier.

Where to see violations

  • Live Events — affected rows show a VIOLATION badge inline
  • Audit tab — dedicated "Pre-consent violations" section listing every offender with timestamp
  • Tags tab — affected tag cards get a pre-consent badge
  • Audit report export — full violations section with recommended fixes

Why this matters

Tracking before consent is the #1 source of GDPR / ePrivacy violations our users hit. Regulators (CNIL, DPC, Garante) have issued multi-million-euro fines specifically for tags firing before consent. Pixel Auditor flags it in red.

Common causes

1. CMP loaded after the tag

The most common pattern. Your tag library loads at the top of <head>, the CMP loads later, the tag fires its first hit before consent is even prompted.

fix Move the CMP above any tag library in <head>. Set Consent Mode defaults to denied at the very top of the page, before any other tracking script.

2. Hardcoded fbq on every page

Meta Pixel installed via direct <script> rather than gated through GTM's Consent settings. fbq('init', …) followed by fbq('track', 'PageView') fires before any consent UI renders.

fix Move Meta Pixel into GTM and set the trigger to require ad_storage = granted. Or wrap the hardcoded snippet in a CMP callback.

3. Async tag with no Consent Mode integration

LinkedIn Insight, Bing UET, and other non-Google trackers don't have native Consent Mode support. They fire as soon as their script loads.

fix Gate these tags through GTM, set the trigger condition to a custom event your CMP fires on consent grant.

4. SPA route handler firing before CMP renders

The first route change handler runs before the CMP banner has finished mounting. The page_view on the very first route is pre-consent.

fix Wait for a "consent_update" custom event before binding any analytics route handlers.

5. Direct gtag() call without checking consent state

Custom event-tracking code calls gtag('event', …) directly without checking consent. The event fires as soon as the page is interactive — usually before consent.

fix Queue all custom events. Flush the queue only after the CMP confirms consent. Or push them via dataLayer.push with a GTM trigger gated on consent.

Verifying the fix

  1. Click Reset Consent in the simulator (or open in incognito).
  2. Reload. Watch the Live Events stream from a clean state.
  3. Confirm: only modeled (G100) Google pings between page load and CMP click.
  4. Click Accept in the CMP. Confirm: tracking fires now appear with G111 / no PII.