Your consent banner is not blocking anything

Section 1

Required changes

In order. Each step names the location and the action.

1. Turn on blocking in your consent app

   Fixes 5 of 7

   7 trackers continued after the reject control was pressed. Consentmo is set to notice only, which displays the banner and blocks nothing. In the Shopify admin open Consentmo, go to Cookie blocking, change Notice only to Block before consent, and add every tracker listed in section 4 to the block list.

2. Remove the Meta Pixel that is hard-coded in your theme

   Theme edit required

   Two copies of the Meta Pixel were recorded. One loads through the consent app. The second is inline in theme.liquid and is outside the consent app's control. Search the theme for fbq( and remove that block. Re-add the pixel through the consent app or through Shopify Customer events.

3. Set Google Consent Mode defaults

   Also affects EU conversion reporting

   Google tags are present with no declared default consent state, so they execute on load. In Google Tag Manager add a Consent Initialization trigger that sets ad_storage and analytics_storage to denied, and grant them from the consent app after the visitor agrees.

4. Remove or gate Hotjar on product pages

   Session recorder

   Hotjar records pointer movement, scrolling, and keystrokes. It was recorded on the product page at 1120ms. Add Hotjar to the consent app's block list, or remove it from pages that contain input fields.

5. Re-scan and retain the report

   Verification

   Run the scan again after the changes above are live. Retain the dated report as a record of the date the configuration changed.

Section 2

Requests recorded before consent, by page

Each bar starts at the first byte of the page and ends at the request to that company. No element was clicked, scrolled, or typed into during any of these recordings.

Section 3

Behaviour after consent was refused

The homepage was loaded, Reject All was pressed, and the page was loaded again in the same browser so the stored choice applied. The table records what executed on that second load.

7 of 9 executed after consent was refused. The 2 that stopped are the 2 present in the consent app's block list.

Section 4

Cookies set before consent

Recorded on first load, before consent. The 2 marked Necessary are permitted before consent. The other 9 are not.

Section 5

Method and limitations

• Each page was opened in a browser with no cookies and no history, from a California address. Each page used its own browser context.
• Each page was observed for four seconds. Every outbound request was recorded. No element was clicked, scrolled, or typed into.
• For the refusal test the homepage was loaded again, the reject control was pressed, and the page was reloaded in the same browser.
• Cookie descriptions are taken from the Open Cookie Database. Requests to unidentified hosts are reported as unrecognised and are excluded from all counts and from the verdict.
• This report records observations from one browser on one date. It is not legal advice.

Snitch · report SN-2026-0304-NLC · 2026-03-04 · run your own scan