Sample consent and pre-consent tracking report

An anonymized sample of a consent-focused beacon audit: which trackers fire before consent is given, and what the report flags.

Illustrative sample. The company, domain, and every identifier below are fictional and anonymized — this is what a consent-focused audit looks like, not a real site's data. Plain-language orientation, not legal advice.

The audited site (fictional)

Northwind Traders, a fictional mid-size B2B software company at shop.northwind.example. Consent banner present (fictional CMP "ConsentCo"). Method: static scan plus a first-visit browser render with no consent given — any marketing tracker firing in that state is firing pre-consent.

Findings (excerpt)

Tracker	Embedded via	Fires pre-consent?	Finding
ConsentCo CMP	Direct script	Yes (required)	Present on all pages — good
Meta Pixel (100000000000001)	Hardcoded in base template	Yes	Pre-consent firing — bypasses the CMP
Google Analytics 4	Via GTM, consent-gated	No	Correctly held until consent
LinkedIn Insight Tag	Via GTM, consent-gated	No	Correctly held until consent
Hotjar (3000001)	Hardcoded on pricing/signup	Yes	Pre-consent firing — session replay before consent
reCAPTCHA	Direct, form pages	Yes	Security use — documented exception

What the findings led to

1. Moved the Meta Pixel into the tag manager behind the marketing-consent rule — it had been hardcoded in the base template, firing on every page load regardless of the banner.
2. Migrated Hotjar into consent gating — session replay is the highest-risk pre-consent tracker; it now loads only after the visitor accepts functional cookies.
3. Documented the reCAPTCHA exception — security script on form pages, noted in the privacy review rather than removed.

Re-render after the fix: zero marketing trackers fire pre-consent. GDPR & CCPA consent basics · what audits can and can't verify.