A commenter noted that Consent Management Platforms like OneTrust are not foolproof, as their reliance on periodic scans can allow new tracking scripts to go undetected for weeks.

{
  "signal_id": "ccc920c7-2dae-59e2-a0ca-33caaa192373",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-09-13T09:24:38+00:00",
  "company": {
    "name": "OneTrust",
    "domain": "onetrust.com"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "ongoing_state",
    "topics": [
      "gdpr",
      "compliance",
      "cmp",
      "privacy"
    ],
    "post_id": "1wf2yv2",
    "summary": "A commenter noted that Consent Management Platforms like OneTrust are not foolproof, as their reliance on periodic scans can allow new tracking scripts to go undetected for weeks.",
    "category": "reliability",
    "comments": [
      {
        "url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/comment/p9ile33/",
        "depth": 0,
        "score": 8,
        "author": "TrackTeddy",
        "excerpt": "Sounds like you’d not configured the cookie banner to load early enough on the site.",
        "posted_at": "2026-09-13T09:29:11.000Z",
        "author_url": "https://www.reddit.com/user/TrackTeddy/"
      },
      {
        "url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/comment/p9im6lu/",
        "depth": 0,
        "score": 4,
        "author": "rubenknol",
        "excerpt": "it's either a script loading order issue, or a configuration issue on your part - you need your cookie banner to load before anything else, and you need to connect your cookie banner to google analytics to inform it of cookie consent value captured",
        "posted_at": "2026-09-13T09:35:49.000Z",
        "author_url": "https://www.reddit.com/user/rubenknol/"
      },
      {
        "url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/comment/p9jfgc9/",
        "depth": 0,
        "score": 4,
        "author": "erparucca",
        "excerpt": "as far as I remember, google analytics is not GDPR compliant out-of-the-box, it has to be customized. https://www.cookieyes.com/blog/google-analytics-gdpr/",
        "posted_at": "2026-09-13T12:59:55.000Z",
        "author_url": "https://www.reddit.com/user/erparucca/"
      },
      {
        "url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/comment/p9iwoak/",
        "depth": 0,
        "score": 3,
        "author": "Comfortable-Fall1419",
        "excerpt": "Why are you conflating when Google loads with what country the visitor is from?\n\n You can configure Google to wait for the privacy cookie to be set.\n\n Also it’s not actually wrong for Google to fire before the banner as long as it’s only collecting anonymous data.",
        "posted_at": "2026-09-13T11:00:11.000Z",
        "author_url": "https://www.reddit.com/user/Comfortable-Fall1419/"
      },
      {
        "url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/comment/p9im78n/",
        "depth": 0,
        "score": 2,
        "author": "demihitman1",
        "excerpt": "Manual testing gets old really fast once you're dealing with different regions. The annoying part for me wasn't even using a VPN, it was figuring out what half the request in devtools belonged to.",
        "posted_at": "2026-09-13T09:35:58.000Z",
        "author_url": "https://www.reddit.com/user/demihitman1/"
      },
      {
        "url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/comment/p9kfi3a/",
        "depth": 0,
        "score": 2,
        "author": "Cold_Arachnid_2617",
        "excerpt": "Don't blame Google Analytics. Blame your poor coding skills. if you don't know what you are doing, hire someone who does!",
        "posted_at": "2026-09-13T15:48:28.000Z",
        "author_url": "https://www.reddit.com/user/Cold_Arachnid_2617/"
      },
      {
        "url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/comment/p9lyc7d/",
        "depth": 0,
        "score": 1,
        "author": "Tough-Gas-2019",
        "excerpt": "Common issue, GA/GTM tags firing before consent, usually from a misconfigured trigger or a script the CMP isn't controlling.\n\n Worth knowing: CMPs like OneTrust or Cookiebot aren't foolproof. They rely on periodic scans (weekly/monthly, not daily), so a new script or tag can slip through undetected for weeks.\n\n Recommendation: run an independent script-based check on your site at least annually (q",
        "posted_at": "2026-09-13T19:26:45.000Z",
        "author_url": "https://www.reddit.com/user/Tough-Gas-2019/"
      },
      {
        "url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/comment/pa24vul/",
        "depth": 0,
        "score": 1,
        "author": "ScaleSweet5236",
        "excerpt": "Nobody has answered the actual question yet (how to test it), so here's how I do it manually, then why it happens.\n\n Fresh incognito window, DevTools > Network, load the page and don't touch the banner. Filter the list by collect. Every hit to google-analytics.com/g/collect or analytics.google.com/g/collect is a GA4 event. Look at the gcs query param on those hits: G100 means Consent Mode is in th",
        "posted_at": "2026-09-15T23:22:05.000Z",
        "author_url": "https://www.reddit.com/user/ScaleSweet5236/"
      }
    ],
    "evidence": [
      "[comment u/Tough-Gas-2019] Common issue, GA/GTM tags firing before consent, usually from a misconfigured trigger or a script the CMP isn't controlling.",
      "[comment u/Tough-Gas-2019] Worth knowing: CMPs like OneTrust or Cookiebot aren't foolproof. They rely on periodic scans (weekly/monthly, not daily), so a new script or tag can slip through undetected for weeks."
    ],
    "virality": "somewhat_high",
    "post_date": "2026-09-13T09:24:38.000Z",
    "post_kind": "text",
    "post_text": "I recently started advertising to people in the EU and noticed something I wasn't expecting. Google Analytics was already tracking visitors before they'd made a choice on the cookie banner.\n\nI'd always assumed that having the banner set up meant the tracking behind it was being handled properly, so this sent me digging into what was loading before someone clicked accept or reject.\n\nNow I'm wondering how people normally test this stuff because doing it manually seems like a pain. If you want to see what happens for visitors in different countries you need to test from those locations, which means using a VPN or something similar, then sitting in devtools watching individual requests. Even then it isn't always obvious which third party owns a particular request.\n\nFor anyone managing sites with traffic from multiple regions, how are you checking this? Do you manually test from different locations or is there a reliable way to scan the site and see what's firing before and after consent?",
    "sentiment": "negative",
    "subreddit": "gdpr",
    "post_flair": [
      "Question - General"
    ],
    "post_title": "Found out Google Analytics was tracking EU visitors before they gave consent",
    "prominence": "aside",
    "source_url": "https://www.reddit.com/r/gdpr/comments/1wf2yv2/found_out_google_analytics_was_tracking_eu/",
    "entity_role": "vendor",
    "post_author": "Elegant-Drummer",
    "upvote_ratio": 0.92,
    "mention_count": 1,
    "mention_surge": false,
    "subreddit_url": "https://www.reddit.com/r/gdpr/",
    "total_upvotes": 21,
    "comments_total": 13,
    "total_comments": 13,
    "other_companies": [
      {
        "name": "Cookiebot",
        "role": "alternative",
        "domain": "cookiebot.com"
      },
      {
        "name": "Google",
        "role": "partner",
        "domain": "google.com"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/Elegant-Drummer/",
    "signal_category": "feedback",
    "comments_included": 10
  }
}

curl https://signals.autobound.ai/v1/signals/ccc920c7-2dae-59e2-a0ca-33caaa192373 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"onetrust.com","limit":20}'