use cases

A Lender's Reject Button Loaded the Ad Tags Anyway, and Google Consent Mode Reported Granted

Marlow Home Loans, another made-up business from PXTA’s test fixtures, did more than most sites. Its tags really do wait for the cookie banner, a Usercentrics one. Before a visitor answers, PXTA’s first pass saw nothing from Microsoft’s UET tag or the X Pixel. On a quick manual check the site looks careful.

The bug is in the second pass. The site’s code loads its tags when the visitor answers the banner, any answer. “Deny” counts as an answer, so a visitor who rejects tracking gets the full set.

Findings in the Marlow Home Loans sample report: on every page, Google Analytics 4 reported Google Consent Mode as granted (G111) after the visitor rejected tracking.

The Banner PXTA Couldn’t See Into

Marlow’s banner sits in a closed shadow root, which keeps its buttons out of reach of any script on the page, PXTA’s included. PXTA finds a banner like that by what’s drawn on the screen and answers it through the platform’s own JavaScript API, here UC_UI.denyAllConsents(). The report records how each pass was answered, so nobody has to take the rejection on trust.

Granted, After a Reject

The site also sets Google Consent Mode to “granted” by default and never changes it. So after the visitor rejected, Google Analytics went on reporting gcs=G111: ad storage granted, analytics storage granted. PXTA reads that code from every Google request and flags it:

On /loans/debt-consolidation, Google Analytics 4 reported Google Consent Mode as granted (G111: ad_storage granted, analytics_storage granted) after the visitor rejected tracking.

That’s a high-severity finding on its own: Google’s tags are told consent exists when the visitor said the opposite.

Pages About Money Trouble

A lender’s pages say a lot about the people reading them. PXTA’s sensitive-page rule treats words like debt, bankruptcy, arrears and payday as signs of money trouble. A mortgage calculator isn’t flagged; a debt consolidation page is. After the reject, the UET tag, the X Pixel and Google Analytics all sent /loans/debt-consolidation, and a search for “bankruptcy” went to all three:

On /search?q=bankruptcy, the Microsoft Advertising UET tag sent the search term “bankruptcy” after the visitor rejected tracking.

The Fix

Two lines of the site’s own code: load the tags only when the answer is “accepted”, and update Consent Mode from the banner’s answer instead of hard-coding it. A rerun should show the consent behaviour table going from “ignores reject” to “respects the choice” for every tracker.