Cookies set before consent
Of everything the cookie scanner reports, cookies set before consent is the finding that matters most. This page explains what it means, why it is such a strong signal, where these cookies usually come from, and what to do about them.
What before consent means
When the scanner opens a site, it records the browser state twice: once when the page first loads, before it touches anything, and again after it deliberately clicks accept all. "Before consent" is that first snapshot. It is everything the site put in the browser while the visitor was still just looking at the banner, before they clicked accept, reject, or anything else.
So a cookie flagged as set before consent is not a maybe. The scanner watched it land in the browser at a moment when the visitor had made no choice at all. The accept click came afterward.
Why it is the headline compliance signal
Under the GDPR and the ePrivacy rules that sit alongside it, consent for non-essential cookies has to come first. The order is the whole point: you ask, the visitor agrees, and only then do the analytics and marketing cookies get set. Essential cookies, the ones a site genuinely needs to function, are treated differently, but tracking and advertising cookies are not essential.
That is why the timing is what the scanner watches. A cookie that already exists before the visitor clicks anything was set without consent, full stop. An accept click a moment later cannot reach back in time and bless a cookie that was already there. Consent is permission to do something next, not forgiveness for something already done. This is also why a beautiful, perfectly worded banner can still fail the test: if the trackers fire while the banner is still loading, the words on the banner never mattered.
The usual suspects
When the scanner flags cookies before consent, the cause is almost always one of a few familiar patterns:
- A tag manager firing on page load. The most common culprit. A tag manager is configured to load its tags as soon as the page opens, so every analytics and advertising tag inside it fires before the banner is even answered.
- Hardcoded pixels. An advertising or analytics pixel pasted straight into the page template runs the instant the page loads, with nothing gating it.
- A consent platform in notify-only mode. Many consent tools can either actively block cookies until consent, or simply show a banner while letting everything run underneath. Installed in the second mode, the banner is decoration. It informs, but it does not block, so trackers fire regardless of what the visitor clicks.
- Third-party embeds. Video players, chat widgets, social buttons, and similar embeds often set their own cookies the moment they load, independent of your consent flow, because they were never wired into it.
How to verify with the scanner
To confirm the problem and, later, your fix, run the site through the scanner and read two things:
- The set before consent number in the scorecard. Anything above zero means at least one cookie landed early.
- The set before consent flag in the cookie list. It marks the exact rows, so you can see the cookie name, its vendor, and its category, and trace each one back to whatever is loading it.
After you make a change, scan the page again. Remember the report is cached for about a day per page, so if you need a fresh result right away, scan a different page of the site, since query strings are ignored and will return the cached copy.
How to fix it
The fix depends on where the cookie comes from, but it is almost always one of these:
- Gate your tags behind the consent callback. Instead of firing tags on page load, fire them only after the visitor accepts. Most tag managers and consent platforms expose a signal or callback for exactly this. Move the non-essential tags behind it.
- Turn on prior blocking in your consent platform. If your consent tool supports actively blocking cookies until consent, switch it from notify-only into that blocking mode. This is often a single setting.
- Sidestep the problem for analytics. Some tracking does not need cookies at all. Cookieless analytics measures traffic without planting an identifier in the browser, which removes a whole class of before-consent findings for your analytics in one move. GetFluxly's cookieless analytics works this way.
Not legal advice
Note: this page explains a technical signal, not the law. Whether a specific cookie is essential, and what your site needs to do to comply, are decisions for a qualified professional who knows your situation. The scanner and these docs help you see what your site does. They do not tell you whether it is compliant.