No Consent Violations Detected
0 confirmed violations · 1 vendor analyzed · s3_fresh_load_optout_preset
No confirmed consent violations were detected at https://example.com under the s3_fresh_load_optout_preset methodology.
Under CCPA/CPRA, GPC is a legally binding opt-out signal. California's CPPA has stated GPC non-compliance is enforceable without prior notice.
| Vendor | Signal / Cookie | Category | Legal Risk | Status | Observation |
|---|---|---|---|---|---|
| OneTrust | OptanonConsent, OptanonAlertBoxClosed | Functional | Unknown | Passed | — |
OptanonConsent) were observed but the OneTrust JS API was not detected during the scan window. The CMP is likely loading asynchronously past the networkidle threshold. Manually verify by inspecting window.OneTrust in browser DevTools, then consider re-scanning with a longer wait.The compliance argument and the commercial argument for proper Consent Mode implementation are aligned, not in tension:
- Without proper consent signals: advertising data is both legally questionable AND commercially degraded
- Properly implemented Consent Mode V2 satisfies GDPR requirements AND preserves advertising performance
- An audit finding of "CMP present but Consent Mode not implemented" is simultaneously a legal risk AND a business performance problem
Sites that implement consent banners WITHOUT Consent Mode V2:
- EU/UK sites: 30–50% of conversions go unattributed
- Sites with cookie walls: up to 60% unattributed in opt-in jurisdictions
- Advanced Consent Mode with modeling: recovers approximately 65–80% of lost conversions
- Basic Consent Mode: no recovery — conversions simply absent from reports
Consent Mode is a signaling system between a CMP and Google tags (GA4, Google Ads). When consent is denied, tags adjust behavior:
- Basic Mode: Tags are completely blocked — no data reaches Google
- Advanced Mode: Tags fire but send cookieless "pings" for behavioral modeling
Mandatory for EEA/UK advertisers using audience features or remarketing since March 2024.
The gcs= URL parameter in Google Analytics and DoubleClick requests encodes consent state.
Format: G1AB where A = ad_storage, B = analytics_storage. 0 = denied, 1 = granted, - = unset.
| GCS Value | ad_storage | analytics_storage | Meaning |
|---|---|---|---|
G111 |
granted | granted | All consent granted (or Consent Mode not configured) |
G100 |
denied | denied | Full opt-out — ACM cookieless pings only |
G101 |
denied | granted | Partial opt-out — ad tracking denied, analytics still active |
G110 |
granted | denied | Partial opt-out — analytics denied, ad tracking still active |
G1-- |
unset | unset | Consent Mode present but signals not yet set (timing/race condition) |
| No gcs= | n/a | n/a | Basic Consent Mode (tag blocked entirely) or no Consent Mode |
Key audit signals for S3 opt-out tests:
- G100 = ACM correctly implemented — cookieless pings only, correct response to opt-out
- G101 = Partial CCPA compliance — ad_storage denied but analytics_storage still granted. Under CCPA, "Do Not Sell" must cover analytics profiling, not just ad delivery. This is a compliance gap.
- G110 = Partial compliance (inverse — rare in practice)
- G111 in S3 test = CMP integration failure — opt-out not propagating to Consent Mode at all
Key audit signal: If gcs=G100 appears in network requests → the tag FIRED despite denied consent. This is Advanced Consent Mode — the tag is not blocked, it sends a cookieless ping.