Third-party tracking cookies set on page load with no consent banner

This check inspects the actual Set-Cookie response headers the server sends back, which is a more reliable signal than reading page scripts, and looks for third-party tracking cookies being set as soon as the page loads. On this site, tracking cookies were set on the initial page load, and no cookie-consent banner was detected at all. Tracking cookies firing before a visitor can make any choice breaches GDPR (General Data Protection Regulation) Article 7 and Europe's ePrivacy Directive Article 5(3) for any EU or UK visitor. Because this check reads the real Set-Cookie response headers rather than just scanning for script tags, it catches trackers that a script-only scan would miss entirely. Your developer should install a consent manager that actually blocks these cookies from being set until the visitor clicks Accept, rather than a purely cosmetic banner. This is a more substantial fix than adding a banner alone, since it requires identifying every tracker responsible for the cookies found and wiring each one to the consent state, typically a day or more depending on how many trackers are involved.