The gate is not where you think it is
Most people picture consent as a gate standing in front of every tag on the site. The visitor answers, the gate opens or stays shut, and nothing gets past it either way.
It is a gate in front of one road. Anything installed outside that road is on a different route with no gate on it at all, and the consent platform has no way of knowing it is there.
There are three common ways a tracker ends up on the other road. None of them are malicious and all of them are boring.
Route one: the hardcoded script in the template
Somebody needed a remarketing pixel live before a campaign launched on Monday. The tag manager felt like a detour, the developer had the layout file open anyway, and the script went straight into the header.
It worked. The campaign ran. Nobody revisited it, because there was never a reason to.
That script now loads on every page, before the consent platform initialises, and it will keep doing so through every redesign that copies the header forward. It is invisible to the consent tool permanently, because the consent tool only knows about tags that pass through it.
Route two: the SDK that loads other SDKs
A chat widget. A session recording tool. A personalisation vendor. You approved one script and what arrived was a loader that fetches three or four more at runtime, some of them from domains you have never heard of.
If the consent platform knew about the parent it may have blocked it. It never saw the children, because the children did not exist at the moment anybody was making decisions about what to block.
Route three: platform-injected tags
Ecommerce platforms, CMS plugins, ordering providers, booking engines and reservation systems that inject their own analytics as part of the service.
The site owner did not install these and frequently cannot name them. They arrive with the platform, they update with the platform, and the only notice of a change is a line in a release note nobody on the marketing side reads. We took one vertical apart on exactly this point in your restaurant website is not one website.
Why asking does not find them
Every one of those steps was reasonable when it was taken, and each was taken by a different person, often at a different company, often years apart, and usually with no record beyond the change itself.
There is no single person to ask. Which is why an inventory of what actually loads has to be observed rather than collected by survey. A questionnaire returns what people remember installing. The network tab returns what is installed.
What this looks like at scale
Our Website Privacy Index scanned 47,505 public websites and scored 47,419, January to September 2026. Of the 1,475 where a consent platform was detected, 620 (42.0%) tracked anyway, either before any interaction with the banner or after a refusal.
Note which direction that finding runs. The common case is not a site blocking incorrectly. It is a site where the answer the banner collected was never wired to anything, often because the things that needed wiring were never in the tag manager to begin with. The parent argument is in more than a third of cookie banners do not block anything.
The check, ten minutes, no tooling
- Open the site in a clean browser profile or a private window. Not your everyday browser, which is full of state that changes what loads.
- Deny everything on the banner. If there is no banner, carry on anyway.
- Open the network tab and reload. Browse two or three pages, including one deep page such as a product, menu or booking flow.
- Filter to third-party requests and read the hostnames. Write down every domain that is not yours.
- Anything on that list you cannot account for is the finding. Not a violation, not a verdict. A tracker nobody currently owns.
What to do with the list
For each item there are three options: route it through the tag manager so the consent platform can govern it, block it at the consent platform by vendor if that is supported, or remove it because nobody can say what it is for.
Which of them you are permitted to keep, and under what conditions, is a question for your counsel and not for us. What we can tell you is what is there.
Two ownership questions
Who approves a new tracker on your site? And if somebody added one last quarter, would you find out? If neither has an answer, the list you just made will be out of date within a month, which is the point we argued in your vendor changed 200 things on your site.
Configuration moves between audits, which is the argument for watching it continuously rather than checking it once. That is what Managed Privacy does. For a single review of the whole tag layer, book a data and tracking audit.
Not legal advice. Rawsoft determines what a system technically does: which tags fire, when, under what consent state, and what data is transmitted. We do not determine which laws apply to your organization, how a regulator would read them, or whether your organization is in compliance. Those are determinations for your counsel. Everything above describes behavior an automated scan observed on public pages at the time of the scan, and nothing in it is a legal conclusion about any site.