Cookies are being set before consent

[ShannonTrust]

Please select the priority level by adding one of the following labels to this issue?

Priority-3 (Normal e.g. Functionality is not working for a subset of users)

Describe the bug and the expected behaviour.

We've had our monthly report from Cookiebot and it's come back again saying cookies are being set for users before they can consent. Cookiebot is a bit of a minefield for me so I have no idea where to make the changes. Would you be able to look into this, please?

Steps To Reproduce

This is the report for the full details:
Cookie scan report August 2024.pdf

Screenshots or a link to a Loom Recording

No response

What browsers are you seeing the problem on?

No response

Anything else?

No response

[cyberteenie]

@ShannonTrust - we will have a look and get back to you on this! Thanks for flagging

[AbdelhalimOJ]

Progress Status:

• Ensure Proper Script Order: Make sure the Cookiebot script is the very first script to load on your website. This might involve adjusting the order of scripts in your website’s section.
• Classify Unclassified Cookies: Log in to your Cookiebot account and manually classify any unclassified cookies. This involves providing a purpose description and categorizing them correctly.
• not applicable - Handle Server-Side Cookies: If there are any server-side cookies being set, you will need to modify your server-side code to delay setting these cookies until after user consent has been granted.
• not applicable - Review Google Tag Manager Configuration: Check your GTM setup and ensure that all tags are configured to respect the Cookiebot consent mode. This can typically be done by configuring triggers in GTM that check for Cookiebot consent values before allowing tags to fire.

[AbdelhalimOJ]

@ShannonTrust To continue working on this issue, I need access to your Google Tag Manager account. Please invite me at [email protected] to your GTM account.

CC @cyberteenie

[ShannonTrust]

That's all done @AbdelhalimOJ

[AbdelhalimOJ]

Thanks @ShannonTrust I will follow up on this

[AbdelhalimOJ]

Update

It turns out that the GTM is empty, and you're only using Google Analytics to collect user data. So, I made sure the GA script loads only after the user consents and interacts with the Cookiebot banner.

Since our site is hosted on Webflow and is a marketing website without backend cookies, we can skip the step related to server-side cookies. Webflow doesn’t usually set backend cookies unless third-party scripts are used.

Our main priority is ensuring third-party cookies, like Google Analytics, are set only after user consent, which is now managed through Cookiebot.

I believe this will fully resolve the issue.

@ShannonTrust @cyberteenie

[ShannonTrust]

Thanks so much for looking into this for us @AbdelhalimOJ. I'll close the issue, but I'll continue to keep an eye on the Cookiebot reports to make sure nothing else comes up.