Skip to main content
All website issues
Technical Health

Tracking tools load before visitors can consent

What this means for your business

Analytics and tracking tools on this page start collecting visitor data the moment the page opens — before anyone has had a chance to agree to be tracked. This is worth reviewing, especially if you serve visitors in regions with privacy regulations around consent.

How to fix it
Medium
1–3 hours

  1. 1Make a list of every analytics or tracking tool running on your site — Google Analytics, Meta Pixel, LinkedIn Insight Tag, Hotjar, and similar.
  2. 2The simplest fix is to add a consent management platform (CMP): Cookiebot, CookieYes, and OneTrust all offer free plans for small sites. These tools show a consent banner and block trackers from loading until the visitor accepts.
  3. 3Install the CMP's script as the very first script on your page (before GA, GTM, or any pixel). The CMP intercepts the other scripts and holds them until consent is given.
  4. 4If you use Google Tag Manager, enable Google's Consent Mode: in GTM, set analytics_storage and ad_storage to "denied" by default. GA4 will only fire after the visitor consents, while GTM itself continues to load for non-tracking uses.
  5. 5After setup, open your site in a private browser window, open the browser's network tab, and reload. You should see your tracker requests absent until you click "Accept" in the consent banner.
  6. 6Re-scan your site — if the trackers no longer fire before consent, this finding will clear.

On WordPress

Install the free Cookiebot or CookieYes plugin. Both automatically scan your site for cookies, generate a consent banner, and block trackers until the visitor accepts. No code changes needed — activation is enough for most setups.

On Shopify

Shopify has a built-in Customer Privacy API. Go to Online Store → Preferences → Customer privacy and enable the built-in cookie banner. For GA4 and Meta Pixel, use Shopify's native integrations (Sales Channels) rather than custom script tags — Shopify handles the consent gating automatically.

Pro tip: A CMP is the right fix for most small sites — it handles the banner, the blocking, and the record-keeping with minimal setup. Avoid manually writing your own consent logic; the edge cases (returning visitors, opt-out) are easy to get wrong.

Does your site have this problem?

SiteSprout scans your site, tells you which issues you actually have in plain English, and keeps watch so nothing breaks silently.

Scan your site free