What is Prior Consent?

The word 'prior' is where most consent implementations fail. EU ePrivacy rules require consent before information is stored or accessed on the user's device; a banner that appears while the page simultaneously loads analytics, advertising pixels, and session replay has already violated the rule by the time the visitor can respond. Timing is the compliance test, not the banner's existence.

The failure mode is architectural. Tags are traditionally installed to execute on page load — in the HTML head, or in a tag manager container firing on 'All Pages.' Retrofitting consent means inverting that default: every non-essential tag must be held until a consent signal releases it. Common leaks include hard-coded pixels outside the tag manager, scripts loaded by third-party apps and widgets, tags that set cookies during 'initialization' before their consent check, and server-side events sent without consulting consent state.

Prior consent also matters in the US, for a different legal reason: CIPA litigation. Trap-and-trace, pen-register, and wiretapping theories all target data captured before the visitor could consent, because consent is a statutory exception under CIPA. A tracker that waits for an affirmative choice deprives the demand letter of its core allegation.

Verification is empirical: load your site with a clean browser profile, answer nothing, and observe what fires. That before-consent view — the first thing a regulator's or plaintiff's tool records — should show strictly necessary activity only. Anything else in that window is a finding, whatever the banner goes on to say.