DPE-2026-0001

Tracking before consent

A tag fires before the consent question has been answered.

In het NederlandsMeten voor de toestemmingsvraagWat vraag ik hierover, en hoe herken ik een ontwijkend antwoord?

Consent web status active

What it is

On page load, requests go to a measurement or advertising party at a moment when the visitor has not been able to make a choice. There may be a banner or there may not be; either way something was measured before anything was asked. An identifier is usually set at the same time, making the visitor recognisable on a later visit.

Why it is a separate entry

Consent that arrives after the processing is not consent for that processing. Someone opening a page about an illness, a legal conflict or a benefit claim has already signalled that to a third party, and the option not to do so never existed.

How it arises

tag hardcoded in the page rather than behind the consent gate
consent tool blocks cookie placement but not script or container loading
tag added through a dashboard by a team that does not know about the gate

Not to be confused with

If the tag fires but refusing changes nothing, that is Refusal without effect: this entry is about the moment, that one about the effect of the choice. Both can be present at once and they are separate faults, because an operator can fix one and leave the other.

How to establish it

A request to a third-party host carrying an identifier parameter or setting an identifier cookie, timestamped before the consent event. Absent a consent event, the whole capture qualifies.

method network-with-identifierQoD 95

Requirements on the measurement

clean profile; a warm one may carry earlier consent
no interaction: nothing accepted, refused or dismissed
record the country the capture egressed from; consent flows are often geo-targeted

What would refute it

by handThe measurement host is a first-party CNAME to the target domain.Still an exposure, but not third-party by host. Needs DNS resolution at capture time.reclassify
automatedThe request carries no identifier and sets no cookie.There is traffic, but the inference about personal data is weaker.weakens
automatedConsent was granted in an earlier session on the same profile.finding falls
automatedThe tag only fired because the capture clicked something.finding falls

Where this plugs into existing processes

The one question that surfaces itShow me a network capture of the homepage before anyone clicks the banner.

In a DPIA, verify this

Verify that no measurement request leaves before consent is recorded, rather than accepting a statement that tags are 'consent-gated'.

As a procurement clause

On delivery, a capture in the no-interaction state shows no requests to third-party measurement hosts and no identifier cookies.

With a complaint, hand over

A HAR of the no-interaction state, the timestamp of the consent event, and the falsifier list worked through.

Reproduction

repro/frontrun/MANUAL.md · by hand · measurement requests visible before touching the banner
repro/web/check.mjs · script · the run reports DPE-2026-0001 as present, with the detail behind it
repro/bookmarklet/frontrun.bookmarklet.txt · bookmarklet
repro/frontrun/frontrun.mjs · script · at least one request to a measurement host before interaction, plus an identifier cookie

Third parties that can confirm it: urlscan.io, webbkoll, blacklight

Legal framing

nl-tw-11-7a
eu-gdpr-6-1-a

Case law

cjeu-planet49

Objections, and the answer

“Analytics falls under the strictly-necessary exemption.”

The exemption covers what is necessary for a service the user asked for. Audience measurement is necessary for the operator, not for the visitor. Where the analytics party also uses the data for its own purposes, the argument fails entirely.

“The servers are in the EU.”

That answers a different question. This fault is about the moment, not the destination. An entry can be present with the recipient squarely inside the EEA.

“It was one oversight, since fixed.”

Testable. Archived source shows how long the tag was there. An unbroken run of years is not an oversight, and it cannot be repaired retroactively.

“Our consent tool handles this.”

Measure it rather than assume it. A tool that blocks cookie placement may leave container loading untouched.

What this does not establish

harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there

DPE-2026-0002 · Refusal without effect DPE-2026-0003 · No refusal option DPE-2026-0005 · Session recording

How to cite this entry

In text: DPE-2026-0001 (Tracking before consent)
URL: https://totaledigitalewaarborging.nl/register/DPE-2026-0001
Machine: https://totaledigitalewaarborging.nl/register/DPE-2026-0001/index.json
Full: DPE Catalogue. DPE-2026-0001: Tracking before consent. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0001
Measurement: When you publish a finding, cite the method version alongside the entry: “DPE-2026-0001, established under DPE Measurement Method 1.0”

Identifiers are permanent and are never reused. An entry that is deprecated keeps its number and its address, with the reason attached, because references to it exist elsewhere.