Consent is a question of order, not of design. If a tracker runs before the answer, the banner is decoration. We loaded 1,240 public pages with a clean profile and recorded what happened before anyone touched anything.
What fires first
The pattern repeats: the tag manager loads in the head, fires its default container, and the analytics and advertising tags inside it run immediately. The consent script loads afterwards, often at the end of the body, and by then three or four identifiers already exist.
Nothing here is malicious. It is the default configuration of almost every tool, and it survives because the page looks fine either way.
The three failures we see most
Ordered by how often they appear:
How to check yours in ten minutes
Open a private window, load your homepage and inspect storage before clicking anything. Every cookie, localStorage key and pixel you see is one you set without consent. Then click reject and reload: anything that comes back is a second, larger problem.
Do it on a landing page too. Marketing pages collect tools that the homepage never sees.
Fix the order, then keep it
The durable fix is to make consent the gate the tag manager runs behind, and to re-test on a schedule, because the next campaign will add the next pixel. A banner that was correct in March is a claim, not a control.
Find out what fires before your banner appears.
Komploop loads your pages the way a first-time visitor does and reports every identifier set before consent, with the vendor behind it.