Most teams assume they’re compliant because a consent banner is visible.
This case study shows why that assumption can be dangerous — especially when you’re managing multiple domains with shared tracking infrastructure.
A France-based event company running 10 high-traffic websites reached out after receiving repeated GDPR-FR, GDPR, CCPA, and even CIPA notices.
They had a CMP.
They had Google Tag Manager.
They thought they were covered.
They weren’t.
What Actually Went Wrong
Across all 10 sites, we found the same issues:
- Trackers fired before consent
- Tag Manager scripts loaded before CMP initialization
- Geo-based consent rules were never enforced
- Session replay tools were active for US traffic
- Cloned pages inherited broken tracking logic
From a browser’s point of view, consent simply didn’t exist.
Why the CMP Failed (Dev Perspective)
The CMP UI looked fine — but sequencing was broken.
Scripts were injected milliseconds before the CMP lifecycle began.
Custom HTML tags in GTM bypassed consent checks entirely.
Mobile users were auto-accepted.
The dashboard said “compliant.”
The network tab said otherwise.
How We Audited 10 Sites Without Breaking Anything
Instead of scanning pages, we focused on runtime behavior:
- Captured HAR logs on page load
- Tracked script execution order
- Identified pre-consent payloads
- Mapped cross-domain sync calls
- Classified trackers by legal risk
This approach works because browsers don’t lie.
Fixing Compliance Without Killing Analytics
The goal wasn’t to remove tracking — it was to control it.
We:
- Forced CMP to load first
- Blocked all vendors by default
- Rebuilt GTM firing rules
- Segmented EU and US traffic
- Removed legacy scripts
Result: clean consent enforcement and working analytics.
Results (In 4 Weeks)
- 100% elimination of pre-consent tracking
- 18+ hidden vendors identified
- Full GDPR-FR and CIPA compliance
- No new notices after remediation
More importantly, the team finally had visibility into what their stack was doing.
The Takeaway
Compliance failures rarely come from bad intent.
They come from invisible behavior.
If you manage multiple sites, don’t trust dashboards — trust the network tab.
Full case study here:
https://www.auditzo.com/case-study/gdpr-cipa-multi-site-audit
Top comments (0)