Questions about trackers and the cookie consent box

The cookie consent box, the banner that asks a site visitor to accept or reject, is a script like any other. If Google Tag Manager, the Facebook pixel or Google Analytics load first, they send data before the box is even on screen. The box is there. It arrived late. On the page charted at the top, the first tracker loaded 0.268 seconds before the box appeared.

A consent tool holds back only what it has been set up to hold back, and only from the moment it loads. Tags added later inside Google Tag Manager, tags that load ahead of the consent tool, and tags placed by a plugin can all sit outside its reach. The box shows up and looks right while trackers run behind it.

Sometimes. Pressing Reject and a tracker stopping are two separate events, and only one of them shows on screen. Watch and Proof include an After-Reject test that records what still loads once Reject has been pressed.

A server-side relay. Some tools send data from your own server, often through a subdomain of your site, to an outside company. Your web person deletes the tag, the page looks clean, and the data still leaves your server. It never appears in a tag list, so it is easy to miss.

Plugin updates, theme changes, edits inside Google Tag Manager and new marketing tools all add trackers without anyone deciding to. A page that was clean last month can carry a new tracker this week. That is why Watch, Proof and Enterprise check again on a schedule.

An independent third party that checks and records what loads on public pages before a site visitor presses anything on the cookie consent box. Every check is dated and kept as evidence. You decide. We verify.

Your web team, developer or agency. Once they have made a change, we check the page again and record the result with a date. Keeping the check separate from the work is what makes the record worth showing to anyone else.

Five choices, every time: remove it, gate it behind consent, move it off that page, keep it with a written reason, or accept it as it is. On Proof, each choice is logged with who made it and when, and the next check confirms it.

Not on its own. We flag each tracker for review and list the rules it is commonly raised under. What a finding means for your business is a question for your lawyer.

Each check comes from a real page load. It records the page address, the time each tracker loaded to the thousandth of a second, and an evidence digest: a fingerprint of the raw record. Change one character in the record and the digest no longer matches.

You do. Your report is private and sent only to you, and each one carries its own date and evidence digest.

One of four ways: an email to an address at your domain, a DNS record, a file uploaded to your site, or a code sent through your own contact form.

Commonly raised under: the California Invasion of Privacy Act (Penal Code §631 and §638.51), the California Consumer Privacy Act, and on payment pages, PCI DSS 4.0.1 Requirements 6.4.3 and 11.6.1.

6.4.3 asks for a list of every script on a payment page, with a reason for each and a record that it was authorized. 11.6.1 asks for a way to spot changes to those scripts and the page headers, at least once a week. Both have applied since March 31, 2025. Proof checks payment pages every week and keeps the dated record.

Yes. The free check looks at one page, once, with no card. Request a free check.

Watch ($99/mo) checks your key page types every week and runs the After-Reject test. Proof ($499/mo) checks every page type, including payment pages, every week, and adds a screen recording, a dated decision record, and the rule each tracker is commonly raised under.

A tracker is usually added once and shows up on every page built from the same template. Checking each type of page, such as product, checkout, form and article pages, catches it where it matters.

Watch and Proof start with 14 days free. The first charge comes on day 15. Cancel before then and nothing is charged.

Yes. Watch and Proof are month to month.

Enterprise covers five or more sites, checked daily. Email [email protected].