Work through these in order
- 1
A second installation
One common cause is duplicate installation: the pixel is configured in the product and also hardcoded in the theme, installed by a platform app, or added in a container. Gating one does nothing to the others. Search the rendered page and network initiators, not only the repository.
- 2
A tag manager with no consent conditions
The container loaded with denied defaults, but an individual tag inside it has no consent requirement set. Check every tag in GTM Preview, not just the container.
- 3
Consent Mode defaults set too late
Denied defaults established after the container loaded are defaults the tags never saw. Ordering is the whole mechanism.
- 4
A platform or app injecting at runtime
Nothing in the theme, everything in the app. Shopify sales channels and WordPress plugins are the usual sources. The app has to be configured or removed.
- 5
A fourth-party script
An allowed script loading another script you never listed. Follow the initiator chain in the network panel to find what requested it.
- 6
Something that is not a script at all
A remotely loaded font, stylesheet, tracking pixel image or iframe. These are not controlled by a script-only registry when they are already present in markup; omit them, replace them with a local placeholder, or insert them conditionally before the browser starts the request.
The diagnostic setup
- Clean browser profile, no extensions, cache disabled
- Network panel open before the page loads, with preserve log enabled
- Filter by the vendor’s hostname, then clear the filter and look at everything
- Use the initiator column: it tells you which script requested what
- Export the session as a HAR file so the evidence survives the tab being closed
Confirming the fix
A refresh is not a test
Your browser already has the cookies and the cached scripts. Confirm in a fresh profile, or with a scan that starts from a clean state, before declaring it fixed.
Common questions
Why does the scan disagree with what I see?
Usually because your browser is not a first-time visitor: cached scripts, existing cookies, an ad blocker, or a logged-in session. The scan starts clean, which is the condition the rule is about.
A vendor says their script respects consent. Should I trust it?
Verify it. Some vendors read a signal and adjust behaviour rather than not loading, which may or may not be what your jurisdiction requires. The scan tells you what actually happened.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- ICO: guidance on storage and access technologies
Regulator guidance
Checked
- StrongPrivacy verification guide
Product documentation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.