What Happens Before You Click Accept

I check what scripts load before the cookie consent banner appears. On every site I audit, tracking starts before you get a choice. Here’s what I keep finding.

I audit websites for a living. One of the first things I check is what happens before the cookie consent banner appears. The answer, on almost every site I look at, is the same: they’re already tracking you.

How it works

When you visit a website, the page loads from top to bottom. The code at the top runs first. On most sites I audit, the tracking scripts — Google Analytics, Facebook Pixel, Google Ads — are near the top of the page. The cookie consent banner loads further down.

By the time you see “Accept cookies?” on screen, the cookies are already set. Your visit has already been recorded. The question is being asked after the answer has already been decided for you.

What I actually see

I recently audited a local business website. Their Facebook Pixel was firing a Purchase event on every single page load. Not when someone bought something. On every page. Including the homepage. It was sending Facebook a purchase value of £0.00 every time someone visited.

That means Facebook thought every visitor was a buyer. When they ran ads, Facebook couldn’t tell the difference between someone who bought and someone who bounced after three seconds. Their entire ad targeting was broken and they had no idea. They were wasting money every single day.

And all of it was happening before the cookie banner appeared.

On another site, I found Google Tag Manager loading on line 32 of the page source. The cookie consent library didn’t load until line 54. That’s not a grey area. Under UK law, specifically PECR, you need consent before you start tracking. Not after. Not at the same time. Before.

The one that really got me

I audited a school website. Google Analytics was tracking every visitor before the cookie banner appeared. The visitors include children. The school’s own cookie policy listed the tracking cookies and their durations — a 2-year analytics cookie being set on every child who visited the site, before anyone had the chance to say yes or no.

The third-party portals the school used for student records had proper security. Full headers, firewalls, the lot. But the school’s own website, the front door that parents and kids visit every day, had nothing. No security headers, no proper consent, tracking from the first millisecond.

How to check your own site

This takes about 30 seconds.

1. Go to your website
2. Right-click anywhere and select “View Page Source”
3. Press Ctrl+F and search for gtag or gtm or fbq or analytics
4. Note the line number
5. Now search for consent or cookie
6. Note that line number

Why it matters

The ICO hasn’t been fining small businesses for cookie consent issues. Yet. But the direction of travel is clear. And beyond compliance, if your tracking fires before consent, your analytics data is wrong. Your ad targeting is wrong. You’re making business decisions based on broken data.

A proper consent setup costs nothing. It just needs to be done right.