PRV-004
Trackers load without a visible consent mechanism
HighDefault severity · Privacy / Legal · Legal, privacy and consent
Last reviewed
What it checks
Advertising pixels and cookie-based analytics in the page, and known consent-banner tools or banner text.
Why it matters
Loading ad pixels or cookie analytics before consent is a potential compliance risk under GDPR, UK PECR and India’s DPDP Act.
Recommended fix
Add a consent banner that blocks non-essential trackers until the visitor opts in, with an equally easy reject option.
How to verify
Open the site in a private window, decline cookies, and confirm in DevTools → Network that no tracker requests are sent.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue PRV-004: Trackers load without a visible consent mechanism
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add a cookie consent banner that blocks the trackers listed in the evidence until the visitor clicks Accept, offers an equally prominent Reject option, remembers the choice, and lets visitors change it later from the footer. Use Google consent mode defaults set to denied if Google tags are used.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Open the site in a private window, decline cookies, and confirm in DevTools → Network that no tracker requests are sent.References
Potential compliance risk only. This is not legal advice.