Why your CMP is firing tags before consent

Almost every consent failure we find follows the same pattern: the consent platform is configured correctly and something upstream of it is not.

The first culprit is hardcoded tags. A pixel dropped directly into the page template never passes through the tag manager, so no consent gate can see it. Grep your templates for script tags pointing at analytics and ad domains before you trust any dashboard.

The second is tag manager initialization order. If the container loads before the consent state is resolved, default-allow behavior fires everything once. Setting a denied default state before the container script — not after — is the fix.

The third is server-side. Server containers, CDN edge workers, and reverse proxies happily forward events that never touched the browser's consent state. These are invisible to client-side scanners and are increasingly where the real exposure lives.

Verify with network evidence, not configuration screenshots. Load the page with a clean profile in an EU region, record every request before any interaction, and check for identifiers in cookies and local storage. That trace is the only artifact that holds up in a regulatory response.