How it works
In the EU, Article 5(3) of the ePrivacy Directive says information may only be stored on or read from a visitor’s device with consent, unless it is strictly necessary for the service they asked for. Germany implements this in Section 25 of the TDDDG (called the TTDSG until May 2024). Any processing of personal data that follows falls under the GDPR, which sets a high bar for valid consent (Articles 4(11) and 7).
In practice, analytics, ad pixels, embedded videos and maps must wait until the visitor agrees. A consent manager holds those scripts back and releases them after the choice is made, storing the decision itself in a strictly necessary cookie. For fonts loaded from Google’s servers, the Munich Regional Court ruled in January 2022 that passing on visitors’ IP addresses without consent was unlawful.
A banner alone does not protect anyone. What counts is what the page actually requests on first load: if a tag manager fires analytics before the click or a plugin drops tracking cookies, even the best-looking banner does not help.
Why it matters
Tracking without valid consent can lead to cease-and-desist letters, injunctions and fines from data protection authorities. After the 2022 Google Fonts ruling, German sites that loaded fonts from Google’s servers received warning letters in bulk.
For agencies there is a trust problem on top: a theme update, a new plugin or a change to the client’s tag manager container can push trackers ahead of consent without anyone noticing. DomainWarn is not legal advice; whether a given service needs consent is a question for the client’s data protection officer or lawyer.
How to prevent it
- Self-host fonts instead of loading them from Google or other third-party servers; many themes have a setting for this.
- Load every tracking and marketing service exclusively through the consent manager, including containers such as Google Tag Manager.
- Use click-to-load placeholders for videos and maps so the service only loads after consent.
- After every update, open a private browser window, decline nothing and accept nothing, and check in the developer tools which requests and cookies appear on first load.
- Make “Reject” as easy to reach as “Accept”, and keep the privacy policy and the list of services up to date.
How DomainWarn detects it
The Privacy check visits the homepage daily without consent and analyzes the delivered HTML, and when a browser visit is available, every request the page actually makes plus the cookies and storage entries it sets. Fonts from Google or other third-party font servers, tracking and marketing scripts that load before consent and tracking cookies set without consent are warnings and open the incident “Privacy: third parties before consent”. Embeds such as maps and videos, other third-party hosts and services that correctly wait for consent are listed as informational notes, along with any consent manager detected.
DomainWarn does not click the banner: it does not check whether “Reject” really works, how the banner is designed or whether the privacy policy matches, and it gives no legal assessment. The monitor is included in Agency Pro and the trial; the free Privacy check tool is open to everyone.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.