# Third-party scripts that set cookies before consent: the tag audit

Source: https://consentpaladin.com/blog/2026-11-06-third-party-scripts-cookies-before-consent-audit.html

Every WordPress site has a tag genealogy, and the oldest branches are the ones nobody remembers planting. Analytics went through a consent review because everyone knew it tracked. Advertising pixels went through one because the fines were famous. Chat arrived as a customer service tool, was installed by pasting a script, and inherited the trust of its job. Maps, fonts, video embeds, and the marketing pixel someone pasted in 2022 all followed the same path: installed for a function, never reviewed for data behaviour, setting cookies before consent for years.

The audit is a spreadsheet, not a tool. Open the site in a fresh browser, block nothing, and list every request the page makes before any banner is touched. For each request, write down who it goes to, what it sets, and whether it fires before consent. The list is usually longer than anyone expects, because third party scripts load other third party scripts, and the chain runs three or four deep before it stops.

## The usual suspects, in order

Chat widgets are first, because they set persistent identifiers on load, record visit metadata, and in many products profile visitors for sales teams. Their function is support. Their data behaviour is tracking, and the banner has to treat them that way. Embedded video is second: the mainstream players set cookies and contact their servers the moment the embed loads, which is why the two click fix exists, a placeholder image that loads the player only after the visitor clicks.

Maps are third, and fonts are fourth, and both surprise people. A map embed loads tracking alongside the tiles. A font loaded from a third party sends an IP address and a user agent with every request, which is personal data even if no cookie is set. Self hosting the font removes the request entirely, and it is the rare privacy fix that also makes the page faster.

## What the audit finds that the banner misses

The audit finds the tags the banner never knew about, and that is the point of doing it by hand. A consent platform can only govern the tags it knows. A tag pasted into a theme file, a widget, or a plugin setting is invisible to the platform, and it fires on every page load, consent or not. The spreadsheet is how you find it, and the fix is to route it through the platform or remove it, not to add it to a list and hope.

Check the plugins too. WordPress plugins add scripts of their own, and a plugin update can add a new third party without anyone noticing. The audit has to be repeated after plugin updates, not just once a year, because the site changes every time a plugin does. A tag audit is a habit, not a project.

## The number that matters

Count the third parties that fire before consent, and get the number to zero. Not low, zero. Every one that remains is processing without a lawful basis, and the banner that claims otherwise is a record of a claim the site cannot support. The audit takes an afternoon. The gap it closes has usually been open for years.

Keep reading: [Chat widgets that set cookies on load: the support tool nobody ran past consent](2026-11-05-consent-chat-widgets-cookies-on-load.md), [Embedded calendars and cookie consent on WordPress](2026-11-03-consent-embedded-calendars-wordpress.md).

## Frequently asked questions

### Which third-party scripts most often set cookies before consent?

Chat widgets first, then embedded video players, then maps, then third-party fonts. Chat sets persistent identifiers on load. Video players contact their servers the moment the embed loads. Fonts send an IP address and user agent with every request.

### How do I audit third-party scripts on a WordPress site?

Open the site in a fresh browser, block nothing, and list every request before touching the banner. For each one, note who it goes to, what it sets, and whether it fires before consent. Check theme files, widgets, and plugin settings, not just the tag manager.

### What is the two click fix for embedded video?

Show a placeholder image instead of the player, and load the player only after the visitor clicks. The click is consent for that embed, and the player never contacts its server before it.

### How often should I repeat the tag audit?

After every plugin update, not just once a year. Plugins add scripts of their own, and an update can add a new third party without anyone noticing. A tag audit is a habit, not a one off project.