Do cookie banners stop pre-consent tracking?

A cookie banner is a screenshot of intent. Pre-consent tracking is a network log.

A banner that is visible can still sit on top of tags that already ran. WAVE will never show you that. That is why an accessibility-only checker is incomplete for privacy-minded clients.

A cookie banner is the dialog that asks for consent. Pre-consent tracking is any cookie, pixel, or third-party script that runs on the first load, before that choice is stored.

When we tested this, we loaded public URLs in Playwright and did not click Accept. Marketing hosts still appeared. The banner was pretty. The request log was the evidence.

What “before consent” means in a scan

Complience.app’s worker loads the public URL with Playwright and captures cookies and third-party requests during that first load, the same window a new visitor gets. It does not click “Accept.” If a tag fires anyway, it shows up in the cookie category of the report.

That is evidence of behavior, not a ruling under GDPR, ePrivacy, or a state privacy law. The PDF says so.

The UK ICO’s cookies guidance is the sentence to keep next to the table: you cannot set non-essential cookies on the homepage before the user has consented. Consent must be a clear positive action. Continuing to scroll is not that action.

In practice, “before consent” means before any click. If your scan required clicking Accept to “see the real site,” you hid the leak.

Why banners still leak

Common failure modes:

• The CMP snippet loads after Google Tag Manager already injected ads
• “Reject” still leaves analytics cookies
• A cached GTM container ignores the new consent default
• Third-party iframes set cookies the banner never lists

A scanner will not name the law you broke. It will name the host that loaded.

CNIL fined Google €325 million in September 2025 for cookie and advertising-consent failures. It noted Google had already been sanctioned in 2021 for cookie practices (CNIL decision, 3 September 2025). The number is not “your client will be fined €325 million.” It is proof that regulators treat the mechanism, not the existence of a banner.

What actually works is reading the first-load host list with whoever installed GTM. The banner vendor will point at the tag manager. The tag manager will point at the banner. The request log ends the loop.

How to use the report

Send the cookie table with the accessibility issues. Owners can take it to whoever installed the banner. Agencies can bill a “consent evidence” line without pretending to be Cookiebot.

The WebAIM Million still found detectable WCAG 2 failures on 95.9% of top home pages in 2026. Most retainers already send an accessibility PDF. Adding the pre-consent table is the part generic a11y roundups never mention, and the part EU-facing clients actually ask about after a banner screenshot.

The policy text is a different job. What a privacy policy check can prove is whether the notice covers eight topics. It does not show what fired before Accept.

Scan a public URL or read the cookie consent scanner method. If the banner is already Cookiebot, iubenda, Termly, or Complianz, keep it and read the matching note: Cookiebot, iubenda, Termly, Complianz. Those pages are not alternatives. For legal framing, keep the disclaimer on every PDF.