Skip to main content

Insight · Consent, data protection & tracking quality

Correctly classify Consent Mode without equating it with consent

Consent Mode transmits states to tags, but does not replace user decision or legal assessment. The banner remains the controlling interface.

For website operators and data protection officers, "Consent Mode is not consent" illustrates the difference between "Separate Responsibility" and "Former Default." "Consent Substitute" is the typical warning sign.

Published: 3 min read · Author:

The CMP or other approved logic captures and manages the user's decision; Consent Mode maps selected states for supported tags. Default values ​​must be set before tag execution, updates must be correctly propagated, and actual requests and modeling assumptions must be evaluated separately.

Consent Substitute

  • Consent Substitute A technical mode is used as justification, even though user information and the required selection are missing.

  • Update Too Late Tags can start with an incorrect default before the stored state is applied.

  • Anonymity Assumption Cookieless signals are not automatically anonymous and must be evaluated according to their actual content and purpose.

Diagnostic Case: "Consent Substitute"

The CMP stores a rejection and sends the derived technical status before tag initialization. The network test still checks which cookieless signals are transmitted; these are not labeled as anonymous solely because of the missing cookies.

Previous Default

  1. Purposes and legally authorized CMP states are mapped separately from the technical consent mode signals.

  2. Default and update are implemented consistently for all supported tags in the earliest loading phase.

  3. Clean browser profiles check requests, parameters, memory, and behavior for each relevant selection.

Separate Responsibilities

Test criterion

Separate Responsibilities

Consent capture, legal purpose assessment, and technical tag control are documented as separate layers.

Test criterion

Previous Default

The initial state is determined before supported tags are initialized and any signals are sent.

  • Network Testing The actual request payload is tested for both rejection and consent, instead of relying solely on API calls or UI.

Network Testing

  • Percentage of tested sessions where the consent mode default is correctly set before the first supported tag request.

  • Number of discrepancies between tag states or unexpected payloads between the CMP selection and the observed network.

Defining Cookie Categories Based on Actual Function delves deeper into the "Separate Responsibility" checkpoint. The key question is: How do you properly categorize cookies and similar technologies?

A complementary perspective is offered Fully test tracking and consent before launch.It answers the question: "How can tracking and consent be fully and realistically tested before going live?"

If you want to practically implement "Consent Mode is not consent," you can refer to Robust Website Systems This document focuses on "Technical Consent Management" and "Separate Responsibility."

Consent Mode is a technical translation of states for specific tags. It remains dependent on sound consent logic, early initialization, and actual data flow auditing.

Sources and Further Information

The classification of "Consent Mode is not consent" is based on the following official documentation and standards.

Key Thesis

The consent platform captures and stores user choices; Consent Mode signals derived states to tags. Which processing is permissible must be defined independently.

What This Is Not About

Consent Mode does not obtain consent, makes no legal decision, and does not automatically anonymize or permit transmitted signals.

What it's about

It transmits a technical consent state to certain Google tags so that their documented behavior can be configured accordingly.

More insights

Consent, data protection & tracking quality

Systematically test for consent errors after releases

The "Consent Mode is not consent" checklist includes the following question as a separate audit step: Which consent scenarios should be automatically checked after each website release?

Consent, data protection & tracking quality

Reliably block scripts before consent

Supplements "Consent Mode is not consent" with a separate decision: How can we reliably prevent a script from being executed before consent is given?

Insights Overview

All VELUNO Insights at a Glance

Further analyses on Website Systems, digital visibility, and robust working models.

Practical Implications

Network audit: next checkpoint

A fresh first visit is initially checked for the order of the CMP, default settings, and first tag request. Then, the actual payload is evaluated for each selection.