Auto-blocking scripts: how to prevent tracking before consent
The biggest mistake with a cookie bar is not the wrong button shade. The biggest mistake is when marketing and analytics scripts fire before the user has even made their choice.
At that point the banner exists, but it does not actually control anything.
Auto-blocking of scripts solves exactly this problem. It makes sure that optional scripts run only after consent has been given for the relevant category.
Why showing a banner is not enough
Imagine a website that, as soon as it opens, immediately loads:
- Google Analytics,
- Meta Pixel,
- Hotjar,
- an advertising script,
- affiliate tracking.
A second later the cookie bar appears. The user clicks "Reject all". The problem is that some of the scripts may already have sent data or set cookies.
That state is not acceptable. A cookie bar has to influence the website's actual behaviour.
How auto-blocking works
The principle is simple:
- The CMP identifies scripts and cookies.
- Optional scripts are held back before consent.
- The user makes a choice.
- The CMP runs only those scripts for which consent exists.
- When consent is withdrawn, further execution stops and the setting is updated.
In practice this is technically more demanding, because scripts can be embedded via HTML, GTM, plugins, iframe, embed or external libraries.
What needs to be blocked
Typically the following are blocked:
- analytics,
- marketing pixels,
- remarketing,
- heatmaps,
- session recording,
- social plugins,
- advertising networks,
- personalisation tools,
- some embedded third-party content.
Necessary scripts are not blocked if they are required for the website to function. This can include, for example, security, login, the shopping cart or form protection.
Watch out for Google Tag Manager
GTM is a very common source of problems. The site owner inserts a CMP, but GTM already has tags set to "All Pages". Those can then fire independently of the cookie bar.
The correct setup has to ensure that:
- GTM respects the consent state,
- tags have the right consent conditions,
- marketing tags do not fire before consent,
- after consent is accepted the tags fire correctly,
- Consent Mode signals are set before Google tags start working.
How to test auto-blocking
A practical test:
- Open the website in an incognito window.
- Before clicking the banner, check the cookies in the browser.
- Reject the optional cookies.
- Check whether any analytics or marketing cookies have appeared.
- Reload the page.
- Accept all.
- Check whether the analytics and marketing scripts fired only after consent.
If you have Google Tag Assistant, use it to verify the Consent Mode signals.
What Cookienovo does
Cookienovo combines a cookie scan, a cookie bar, consents and auto-blocking. The goal is that the website does not have to handle each script separately by hand.
When deployed correctly, Cookienovo helps:
- find out which scripts and cookies the website uses,
- sort them into categories,
- block optional scripts before consent,
- run them after consent is given,
- send consent signals for Google,
- keep a record of the user's choice.
Conclusion
Cookie compliance cannot be judged solely by whether a banner pops up on the website. You have to look at what happens before the click.
If marketing scripts run before consent, the banner has not solved the heart of the problem.
Test auto-blocking in Cookienovo and verify that your website does not fire tracking before consent.
Recommended sources:
- ePrivacy Directive, Art. 5(3): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058
- EDPB Guidelines 05/2020 on consent: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
- Google Consent Mode documentation: https://developers.google.com/tag-platform/security/guides/consent
