GA4 Still Firing Before Consent: What To Check

Confirm where GA4 is loaded

GA4 can be loaded through GTM, directly in the page source, through a plugin, or through another platform app. If you only check GTM, you may miss a hardcoded tag that still runs before consent.

• Search the page source for Google tag snippets
• Check GTM tags and triggers
• Review website plugins and ecommerce apps

Check the default consent state

Before the visitor clicks the banner, GA4 should see the expected default consent state. If the default arrives after GA4 fires, the sequence is wrong even if the later state looks correct.

Test reject all with browser storage

After reject all, reload and check cookies, local storage, and network requests. GTM Preview shows tag behavior, but browser storage tells you what the site actually wrote.

Check consent settings on the GA4 tag

In GTM, consent settings decide how tags relate to the consent state. Review built-in consent checks and any additional consent requirements on the GA4 tag.

Use CleanCMP to make the setup easier to audit

CleanCMP brings the scanner, GTM install path, Consent Mode mapping, and proof records into one workflow. That gives you a clearer way to prove whether GA4 follows consent choices.

FAQs

Does a GA4 request always mean cookies were written?

No. Requests and storage are related but not identical. Check both network activity and browser storage.

What if GA4 is hardcoded outside GTM?

Then GTM consent settings may not control that tag. You need to move it into the consent-aware flow or load it after consent.

Can CleanCMP find GA4 cookies?

CleanCMP's scanner can help surface cookies, storage keys, request URLs, and network hosts so you can review what appears before and after consent.