What must not happen before consent

How it works

Under the EU ePrivacy rules (Article 5(3) of the ePrivacy Directive, in Germany § 25 TDDDG) you need consent before you store information on a visitor's device or read it from there. That covers cookies as well as local storage, session storage and IndexedDB. The only exception is what is strictly necessary to deliver what the visitor explicitly asked for: a basket, a login, a language choice or the stored consent decision itself. The GDPR also applies to the processing of the data; for statistics and marketing the basis in practice is consent (Article 6(1)(a) GDPR).

It is not only about cookies. Merely calling a statistics or advertising script sends the IP address and device data to the provider.

bytereport first loads every page in a browser without touching the banner and records which cookies, storage entries and requests appear. A catalogue matches them to services and purposes.

What matters

• No tracking cookies. Cookies and storage entries of statistics and advertising services such as Google Analytics, Meta Pixel or Hotjar only appear after “Accept”.
• No tracking requests. The scripts themselves load only afterwards too. A consent mode defaulting to denied is not enough on its own: in advanced mode, Google tags still send data, just without cookies (more under consent signals).
• Sort out unknown cookies. Cookies we can't attribute to a service are not trackers by default. Only you know whether one is strictly necessary; if it isn't, it belongs behind consent.
• Cloaked trackers. If a subdomain such as stats.your-domain.com points to a tracking service by CNAME, an alias in DNS, the tracker looks like part of your website. It gets past blockers and sets first-party cookies, but needs consent all the same.
• Lifetime of up to 13 months. Supervisory authorities mostly consider more than 13 months too long for tracking cookies. bytereport points out every cookie that lives longer.
• Cookieless statistics. Services such as Plausible or Simple Analytics that work without cookies are not counted as tracking. If they store nothing on the device and read nothing from it, the ePrivacy rule does not apply; the GDPR still does.

How to set it up

Every statistics and marketing script runs through your consent tool or through the tag manager with a consent trigger. Snippets hard-coded in the theme, a plugin or the template often slip through: remove them there and add them via the consent tool. Whoever looks after the website does this, usually in the CMS or the tag manager. A cloaked tracker is set up with a DNS record and removed there too; cookie lifetimes are set in the service concerned.

Test every change in a private browser window: before the first click in the banner, the developer tools must show no tracking cookies and no requests to tracking services.

This is not legal advice; your data protection officer or a lawyer decides the individual case.