Google Consent Mode defaults to 'granted' before visitors choose

Google Consent Mode is a setting that tells Google Analytics and Google Ads tags whether they're allowed to store data on a visitor's device. This check looks at the site's initial 'default' configuration call. On this site, that call sets ad and analytics storage to 'granted' before the visitor has made any choice in the cookie banner, meaning tracking is switched on by default rather than off. Because the default is 'granted', Google receives full advertising and analytics data before a visitor has agreed to anything. This is the most common way sites get Consent Mode wrong, and it is exactly the kind of silent misconfiguration that EU privacy regulators watch for, since it defeats the purpose of asking for consent at all. Standard cookie-scanning tools like OneTrust or Cookiebot won't catch it because it's a misuse of Google's own API, not a missing banner. Your developer needs to change the Consent Mode 'default' call so every storage type (ad_storage, analytics_storage, ad_user_data, ad_personalization) starts as 'denied', then update it to 'granted' only after the visitor clicks Accept in the cookie banner. This is a script change, typically an hour or two of work, and should be tested by loading the site fresh and confirming no data is sent to Google before consent is given.