Free scan

Fix guides

Ad pixel fires before consent or after "reject": how to fix it

An ad pixel that sends data before the visitor accepts cookies, or after they click "reject", breaks EU and UK consent rules. It usually means the pixel is installed outside your consent tool (hard-coded in the theme, added by a plugin or app, or a GTM tag without a consent check), so the fix is to route it through the consent tool or the platform's own consent API.

Check your own site: the free scan tells you in about a minute whether this problem is on your page.

What the finding means

The scan loads your page twice: once without touching the banner, then once after clicking "reject all" and reloading. Fires before the visitor accepts cookies means the pixel sent events before any answer. Keeps tracking after the visitor clicks "reject" is more serious: the visitor said no and data still went to the ad platform. The evidence in your report lists the exact requests.

Google tags are judged differently: with Consent Mode they may send cookieless pings when consent is denied, so they are covered by the Consent Mode checks instead.

Find where the pixel comes from

  • Hard-coded in the site: search the theme or template for the pixel's script (for example fbq('init', ttq.load, bat.bing.com, snap.licdn.com).
  • Installed by a plugin or app: Shopify sales channels, WooCommerce plugins and marketing apps often add pixels directly, outside your consent tool.
  • A GTM tag: look for the platform's tag on an "All Pages" trigger with no consent condition.

Remove duplicate installs, so each pixel loads from one place you control.

Make the pixel wait for consent

Through your consent tool: turn on its blocking of marketing scripts (often called auto-blocking or prior consent) and put the pixel in the marketing category. In Google Tag Manager, open the tag's Advanced Settings, then Consent Settings, choose "Require additional consent for tag to fire" with ad_storage, or fire it on your consent tool's "marketing accepted" event.

With the platform's own consent API:

  • Meta: call fbq('consent', 'revoke') before fbq('init', …), and fbq('consent', 'grant') when the visitor accepts.
  • TikTok: use the pixel's consent mode, calling ttq.grantConsent() when the visitor accepts and ttq.revokeConsent() when they reject, or load the pixel only after consent.
  • Microsoft Advertising (UET): before the UET tag, run window.uetq = window.uetq || []; window.uetq.push('consent', 'default', { ad_storage: 'denied' }); and on accept window.uetq.push('consent', 'update', { ad_storage: 'granted' });
  • LinkedIn, Snapchat, Pinterest, X, Reddit and others: load the tag only after consent, through the consent tool or GTM.

Check that it works

  1. Open the page in a private window, open the Network tab and filter for the platform (for example facebook.com/tr). Nothing should appear until you accept.
  2. Click "reject all", reload, and check again: still nothing.
  3. Run the Plumfinch scan again: the warning should be gone, and the platform should show as "sending events, only after consent".

Sources

Updated 2026-10-27. Based on the platforms' public documentation; menus and names change, so check the linked pages if a step looks different.