You ran a scan, got a list of trackers and a score that looked worse than you hoped, and now you are staring at a page of domain names you have never heard of. That is a normal result. When we scanned 1,430 real websites earlier this year, 82 percent had no detectable consent tool at all.
Here is how to read the report, what to fix first, and how to confirm it worked.
Does finding trackers mean my site is illegal?
No. Finding trackers is normal and expected, because almost every website loads third-party scripts. The problem is not that trackers exist, it is whether they run before the visitor agrees. A tracker that only loads after someone clicks accept is fine. The same tracker on page load is not.
This is the distinction that most scan reports bury and most site owners miss. GDPR and the ePrivacy rules do not ban Google Analytics. They require consent before non-essential cookies and similar technologies are set. So the useful question is not "how many trackers did it find", it is "how many of them fired before I clicked anything".
Which trackers should I fix first?
Work in this order: advertising and fingerprinting scripts first, then analytics, then everything else. Advertising trackers carry the highest regulatory risk because they build cross-site profiles. Analytics is medium risk. Content delivery networks that only serve fonts or scripts usually need no consent at all.
A practical priority list:
- High risk, fix today: Meta Pixel, TikTok Pixel, Google Ads, LinkedIn Insight, Snapchat Pixel, and anything classified as fingerprinting
- Medium risk, fix this week: Google Analytics, Hotjar, Clarity, Mixpanel, Amplitude, and other analytics or session recording tools
- Low risk, usually fine: fonts, CDN-hosted libraries, and other assets that do not set identifying cookies
- Check manually: chat widgets and marketing tools like Intercom or HubSpot, which sometimes set identifying cookies and sometimes do not
If your scan flagged Google Tag Manager, treat it as a container, not a tracker. GTM itself sets few cookies, but everything inside it can. Blocking GTM until consent blocks everything it would have loaded, which is usually what you want.
The four findings we see most often
1. Analytics firing on page load
The classic. The GA4 snippet sits in the head, so it runs before the banner has even rendered. Adding a banner on top of this changes nothing, because the cookie is already set.
2. A banner that exists but blocks nothing
Plenty of sites have a cookie notice that is really just a notification. It says "we use cookies", offers an OK button, and does not gate a single script. Visually compliant, technically not.
3. Reject is harder than accept
One prominent accept button, and reject hidden two clicks deep in a settings panel. This is exactly what France's regulator fined Google 150 million euros and Facebook 60 million euros for.
4. Trackers nobody remembers adding
An old pixel from a campaign in 2023, a heatmap trial someone never removed, an embedded video player pulling in a third-party domain. Scans surface these well, and deleting them is the cheapest fix available.
Is a cookie banner enough, or do I need to block scripts?
A banner alone is not enough. You need prior blocking, which means the tracking scripts do not load at all until the visitor consents. If the script runs first and the banner only records an answer afterwards, the cookie was already set and the consent came too late to matter.
This is the single most common technical failure, and it is the one regulators are actively looking at. Denmark's data protection authority made cookie consent an enforcement priority for 2026, focused on whether users have a real opportunity to say no rather than on how the banner looks.
How do I block a tracker until the user consents?
Remove the tracker's script tag from your site and let the consent platform inject it after the visitor accepts. Do not leave the original script in the page and try to cancel it afterwards. Move it into the CMP so it only ever loads on consent.
With Consentify the flow looks like this:
- Add the script tag to your site:
<script src="https://consentify.app/api/gateway?token=YOUR_TOKEN"></script> - In the dashboard, add each tracker you found as an integration and paste its ID
- Delete the original hardcoded snippets from your templates
- Publish, then reload the site in a private window
After that, the trackers are injected only after consent, and the consent decision is recorded. Anything unusual can go in as a custom integration with its own cookie metadata. The setup documentation covers both paths.
What about Google Analytics and Consent Mode v2?
If you run Google Ads or use GA4 audiences, blocking the tag entirely can break conversion measurement. Consent Mode v2 is Google's answer: the tag loads but runs in a restricted state until consent, sending cookieless pings instead of setting identifiers.
It is a trade-off, not a loophole. You keep modelled conversions, and you accept that a Google script is present before consent. Which route fits depends on whether ad measurement matters to your business. We break down the setup in our guide to Google Consent Mode v2.
How do I verify the fix actually worked?
Re-scan the site and compare. A correct setup shows no high-risk trackers firing before consent. You can also check manually: open a private window, load the site with DevTools on the Network tab, and confirm no requests go to analytics or advertising domains until you click accept.
Two things worth checking that scanners can miss:
- Cookies set on second page load. Some scripts hold off until a session exists. Click through a few pages before you declare victory.
- The reject path. Click reject, then reload, then check that nothing loaded anyway. Accept is the easy path to test, reject is the one that gets sites fined.
Run the free GDPR scan again after the change. Seeing the same site come back clean is the fastest way to know you are done.
The scan says I already have a CMP. Am I done?
Not necessarily. Detecting a consent platform means the script is present, not that it is configured correctly. Plenty of sites run a properly licensed CMP that blocks nothing, because the trackers were never moved behind it.
If the scan detects your CMP and still shows trackers firing before consent, the tool is fine and the configuration is not. Usually the fix is deleting hardcoded snippets that are still sitting in the site template, running in parallel with the CMP.
How long does this take?
For a typical small business site with three to six trackers, expect about 20 to 30 minutes. Most of that is finding where the old snippets are hardcoded. The consent setup itself is a script tag and a few integration IDs.
Platform-specific walkthroughs are here if you need them: Webflow cookie consent, WordPress cookie consent, and Shopify cookie banner.
Got a scan result you want to clear? Set up Consentify free, one domain, no time limit, and re-scan when you're done.