Most site owners install a consent box and consider the question closed. The box appears, a visitor presses something, and the matter feels handled. What the box does not do, on its own, is prevent code from running.
A consent box is an interface element. It displays text and collects a click. Whether anything is actually held back before that click depends entirely on how the box was wired to the rest of the page — and on most sites nobody has ever checked.
The gap is easy to miss because both versions look identical to a visitor. Same box, same wording, same button. The difference is invisible from the front of the page and obvious from behind it.
| Wired to block | Wired to ask |
|---|---|
| Tracking scripts are held until the visitor presses accept. Nothing third-party loads before that. | Tracking scripts load with the page. The box appears alongside them and records a preference afterward. |
| A check run before any click finds nothing. | A check run before any click finds whatever was installed. |
The second version is common, and it is usually nobody's decision. A consent platform gets added to the site. A separate tag manager already holds the tracking. The two were never connected to each other, and no one told the site owner they needed to be.
This takes half a minute and requires no tooling beyond a browser. Do it on your own site.
F12, or right-click and choose Inspect, to open developer tools. Select the Network tab.facebook, google-analytics, clarity, hotjar, or pinterest.Empty list. Your consent box is wired to block, at least for the domains you filtered. That is the outcome you want, and it is worth confirming again after any site change.
Rows appear. Those requests were made and the data went out. Pressing reject afterward does not recall them.
Even a site that checks clean today can stop being clean without anyone touching it deliberately. Three ordinary events do it:
A marketing or analytics plugin ships a new version that adds a tag by default. Nobody reviewed it because nobody thought of a version bump as a change to what loads.
Tag manager access is usually wider than site access. A person adding a conversion tag for a campaign is not thinking about load order relative to a consent box.
Embedded widgets — video players, chat, booking, review displays — load code from somewhere else. When that code changes, your page changes with it, and no one on your side gets told.
This is the reason the check is worth repeating rather than doing once. The state of a page is not a fixed property. It is a snapshot of a particular moment.
An observation is not a legal conclusion, and this article is not offering one. What a check produces is a record: these requests were made, at this time, from this page, before any consent was given.
The rules that get raised in connection with pre-consent tracking are public and you can read them yourself. California's Invasion of Privacy Act sits in the Penal Code. The California Consumer Privacy Act is published by the Attorney General's office. Both are linked at the bottom of this page. What any of it means for your particular site is a question for your own counsel.
We are an independent technical check. Legal advice comes from your lawyer.
We open one page of your site the way a visitor opens it, and record what starts collecting information before anything is pressed. You get the count, the timing, a timestamped screenshot, and a SHA-256 digest of the captured state. One page, once, no charge, no card.
Check my site