StrongPrivacy

Give every tag one installation path.

A banner can be installed correctly while a theme, plugin or tag manager still loads a separate tracking copy. Review where each service starts before publishing your setup.

Start with what is already installed

  1. 1

    List each service and public ID

    Record the analytics property, advertising pixel, chat widget and embedded media used on the site. Use public measurement or pixel IDs, never private API keys.
  2. 2

    Find every installation location

    Check theme or layout code, platform apps, WordPress plugins, custom HTML blocks and each tag-manager container. Ask the person managing advertising about server-side tracking separately.
  3. 3

    Keep one owner per service

    Choose whether StrongPrivacy Managed technologies, your tag manager, or a consent-aware platform integration loads that service. Remove the other installation copies as part of the same release.

Keep a rollback copy

Save your existing tag configuration and container version before changing it. Test on a staging site you control, then publish the consent configuration and website changes together. A staging hostname must be registered for the property; a second hostname does not automatically share a visitor’s choice.

If StrongPrivacy loads the service

  1. Open the property’s Managed technologies section, select a supported service and enter its public ID.
  2. Review its purpose and settings. Save and publish through the property’s normal review workflow.
  3. Remove the same loader and its initialization code from theme files, plugins, apps and tag-manager containers. Keep unrelated features of those integrations where needed.
  4. Clear website and CDN caches. Use a fresh browser session to confirm the service stays blocked when required, loads after its category is allowed, and responds to withdrawal.
Choose a supported service →

If your tag manager loads the service

Keep the vendor in that container and review its consent requirements there. Adding the same vendor under Managed technologies creates a second installation path. Loading a container does not establish that every tag inside it respects consent.

For Google tags, verify that denied defaults are established before the tags run and that choice changes update Consent Mode. Review non-Google tags individually. In your container’s preview mode, test before a choice, rejection, acceptance, category-specific choices and withdrawal. Verify actual requests as well as consent labels.

Choose the behavior you intend

A consent signal and a blocked script are different controls. Some vendor modes can send requests while storage consent is denied. If your configuration requires no optional request before consent, verify that the loader is also gated.
Review Google consent defaults →

Check the platform installation

  • WordPress: keep one StrongPrivacy runtime installation. If the plugin provides it, remove a separately pasted runtime snippet. Review script handles, inline code, dependencies and optimizer exclusions in the WordPress guide.
  • Shopify: check the app embed, theme code, other consent apps and customer-event pixels. The theme extension does not establish consent behavior for every app, checkout or server-side integration. Follow the Shopify guide.
  • Custom sites: place the runtime once in the shared layout. Make optional scripts and frames inert before the browser parses them, and test again after client-side navigation. Follow the custom-site guide.

Verify and hand over the result

Choose representative pages such as the home page, product or service page, contact form and a page with embedded media. Run verification and review both the reached pages and the recorded browser states. Repeat after caching or tag changes.

The scanner flags multiple active StrongPrivacy snippets and repeated declarations of the same recognized vendor script within a page snapshot. It excludes inert declarations and template contents. Different URLs, inline initialization and server-side events still need manual review; repeated declarations alone do not prove duplicate analytics events.

For a client handover, export the scan’s JSON or CSV, record the published configuration version, and keep the tag-owner list with the release notes. Include pages or flows the scan could not cover and name who maintains each tag.

Follow the verification sequence →