Work / EV-06 / Consent · tracking

Ads pixels fired before anyone agreed. Now they wait.

A US costume brand with visitors from Europe had no cookie banner and no US opt-out. Audit, fix and proof, in one fixed-price job.

Client: Costume brand, US
Service: Consent audit and fix
Tested From: Germany, US, Mexico
Stack: Shopify privacy, Consent Mode v2, HAR captures

EV-06a · EU VISITOR, FIRST PAGE VIEW, NO CHOICE MADE● SENDS · ○ WAITS

TOOLBEFORE · 29 SEPAFTER · 30 SEP

Google Ads tag●○

Meta pixel, theme code●○

Affiliate click tracking●○

Product videosTRACKINGDO-NOT-TRACK

Cookie bannerNONEACTIVE

RECORDED AS BROWSER CAPTURES FROM GERMANY BEFORE ANY CHANGE AND AGAIN AFTER THE FIX

FINDINGS AT BASELINE 7 3 high, 3 medium, 1 low. Taken from outside, before admin access.

THE SURPRISE Tracking ran in the EU without consent, yet EU analytics was close to empty. Breaking privacy rules did not even buy usable data.

01 — WHAT I FOUND

No banner for EU visitors
Ads and pixel tracking before consent
Two Meta pixels and two GA4 properties counting the same events
No opt-out for US visitors

02 — WHAT I CHANGED

Shopify's own banner and US opt-out, automated by region. Hard-coded ad tags and affiliate tracking tied to consent, videos in do-not-track mode, an opt-out page and footer links.

03 — HOW IT WENT LIVE

All changes on a copy of the live theme, every original code block logged for restore, then published with the old theme kept as rollback.