GDPR cookie banner: how to stop Google Analytics from loading before consent

You added a cookie banner to your site, it looks nice, it has "Accept" and "Reject" buttons, and you assume you are covered. The problem is that in most cases that banner is purely decorative: Google Analytics, the Meta Pixel and other tracking scripts fire anyway the moment the page loads, before the visitor clicks anything.

That does not make you GDPR-compliant, it just means you have a banner that LOOKS compliant. The difference matters, because this is exactly where a complaint to your data protection authority can catch you. The good news is that it is fixable, and it is neither expensive nor complicated. I will show you concretely how to check whether your banner actually blocks anything, and how to make it stop tracking until consent.

Why your banner probably blocks nothing

Most sites put the Google Analytics script directly in the head, while the cookie banner is a separate plugin added later. The two never talk to each other. The result: Analytics loads and sends data to Google in the very first second, and the banner just shows a message and stores the answer, without stopping anything.

GDPR together with the ePrivacy directive require the opposite: non-essential cookies and scripts (statistics, marketing, remarketing) may only fire AFTER the visitor gives explicit consent through a clear action. A banner that merely informs, along the lines of "by using this site you agree", is not valid consent.

To be compliant, scripts must be blocked by default and released only after the person clicks "Accept". Everything else is cosmetics.

The two-minute test: does data really leave before consent?

You do not have to take anyone's word for it, check it yourself in the browser:

• Open the site in a fresh window (without touching the banner).
• Press F12 to open Developer Tools and go to the "Network" tab.
• In the filter box type: google-analytics or collect or gtag.
• Reload the page and watch WHETHER requests appear before you clicked "Accept".

If you see requests to google-analytics.com or to facebook.com/tr before consent, your banner blocks nothing. The same test works for the Meta Pixel (search for "tr?" or "facebook"), TikTok, Hotjar or any other tracker. It is the simplest way to prove you have a problem and, later, that you fixed it.

The proper fix: block until consent

The core idea is to not load tracking scripts at all until you have a yes. You have a few options depending on how the site is built:

• A real Consent Management Platform (CMP): tools like Cookiebot, Complianz (for WordPress) or CookieYes can automatically block scripts until consent and start them afterwards. The difference from a plain banner is that they do prior blocking, not just show a message.
• Google Consent Mode v2: if you use Analytics or Google Ads, it is practically mandatory. It sends the consent signal to Google, and before acceptance data is limited or not collected at all.
• Conditional loading in code: scripts are injected only after the user clicks accept, via a callback from the banner.

On top of that, categories must be separated (necessary, statistics, marketing), and rejecting must be as easy as accepting, with a visible "Reject" button, not a hidden one.

Common mistakes that still leave you non-compliant

Even with a good plugin, the same mistakes creep in often:

• Cookie wall or forced consent: you may not block access to the site until the person accepts marketing cookies.
• Pre-ticked boxes: consent must be an active action, not something ticked from the start.
• A big colorful "Accept" and a tiny or hidden "Reject": dark patterns like this invalidate the consent.
• No way to change your mind: the user must be able to withdraw consent as easily as they gave it, so you need a permanent "Cookie settings" link.
• No consent log: you must be able to prove who agreed and when, exactly what a serious CMP stores.

And yes, Google Fonts loaded from Google's servers can be a problem too; ideally you host them locally.

How hard it actually is to clean this up

The good news is that for a normal presentation site this is a day's work, not weeks. In practice it means: install a CMP that truly blocks, enable Consent Mode if you use Google, move fonts local, and retest with the Network method above until nothing leaves before consent.

That is how we work at MPO Web Studio: we deliver remotely across the country, we first show you a demo on your own site, and then we do the configuration so it is clean and compliant, with transparent pricing and no surprise costs.

If you want to quickly find out whether your banner actually blocks anything or is just decoration, message us on WhatsApp with your site address and we will honestly tell you what we see and what should be fixed.