Overview
This check crawls the site in its true, untouched default state (a clean browser profile with no cookies pre-seeded and no banner interaction simulated) and confirms that nothing beyond your "Strictly Necessary" tag category fires before a user has explicitly acted on the consent banner.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific GDPR compliance obligations.
Why It Matters
GDPR's consent architecture is opt-in, not opt-out: processing is unlawful the moment a non-essential tracking script executes before consent is recorded, regardless of whether the visitor later accepts the banner.
This makes the "default state" itself the object of legal scrutiny under GDPR in a way that goes further than opt-out regimes, where the harm is typically framed around ignoring a rejection rather than around the pre-interaction window itself. A single marketing pixel firing on first paint, even for a fraction of a second before the CMP initializes, is a documented finding under this standard.
Implementation
Run an Audit with no consent given and a Strictly Necessary consent category that you define, then review which tags the report flags as unapproved
In Consent Categories, create a new approved list for the Strictly Necessary category. Pull in a recent Audit and select only the tags, cookies, and request domains you consider strictly necessary, such as your consent banner. You decide what counts as strictly necessary, so the report reflects your own judgment on each tag. Anything not on an approved list is flagged as unapproved.
Create an Audit with no pre-audit actions, so the crawl represents exactly what a first-time EU visitor’s browser sees before touching the banner. Make sure to select an EU location.
Assign the Strictly Necessary consent category to the Audit. In Consent Categories, select the category, choose the Audit, and click Apply.
Run the Audit and open the pre-built ObservePoint report Pages with Unapproved Tags. Each tag listed fired before consent and is not on your approved list.
Review each flagged tag. If it is genuinely strictly necessary, add it to the category and reprocess the Audit. If not, it is a leak to fix.
Remediation
For remediation, follow the next steps:
For each tag identified firing in the default state, open its trigger configuration in the tag manager and confirm it is gated behind a consent-category trigger tied to explicit opt-in, not merely absent from a block list, but positively required to wait for a granted signal before firing at all, since GDPR's opt-in model inverts the default assumption you may be used to from opt-out jurisdictions.
Where the tag is embedded directly in page code rather than routed through the tag manager (a common root cause for third-party pixels added by a marketing team without engineering review), move it into the governed container so it can be gated the same way as every other tag.
Re-run the clean-profile audit after remediation and confirm the Pages with Unapproved Tags report shows exclusively Strictly Necessary tags before considering the fix complete; treat anything less than a 100% pass rate as an open, high-priority finding rather than a partial success.
Conclusion
This is the foundational check of the entire GDPR framework: because every other consent-behavior check assumes the default state is already clean, a leak here silently invalidates the evidentiary value of every downstream check until it's fixed.