Field note
Consent mode versus what the analytics application actually records
Consent mode, cookie banners, and privacy policies are three different artefacts. An audit has to treat them as such.
On one property we tested, the reject path hid the marketing pixels and left the analytics application’s first-party cookie in place. The banner copy said “essential only”. The application’s debug view continued to show page_view and session_start. The legal page said analytics ran only after consent. Three documents, three behaviours.
We captured HAR files for accept, reject, and withdraw, then repeated the paths in a fresh profile after a banner update the vendor had shipped the same week. Withdraw did not fire a consent-update event. The application kept the previous grant until the cookie expired.
The finding was not that the organisation was reckless. It was that the analytics application had been configured during a migration and never re-tested against the banner the legal team later approved. The repair was a configuration change and a test script the client now runs after every banner release.
We do not write the privacy notice. We do write down, in plain language, what the application recorded on the day we tested it.
If a similar mismatch is sitting on your desk, request a briefing.