The Requests Your Page Makes Before Anyone Touches the Banner
Consent work usually starts at the tag manager. But a page can have a perfectly gated analytics stack and still contact eight third parties the moment it loads, through the plumbing nobody thinks of as tracking: the font file, the map on the contact page, the video thumbnail, the chat badge, the captcha. Each request hands the visitor's IP address and browser details to another company before the banner has been read, let alone answered.
This article explains why pre consent requests matter legally and practically, how to enumerate them on your own pages in one sitting, and the standard fixes, most of which have the side benefit of making pages faster.
Why an IP address in a request is a disclosure
An HTTP request cannot be anonymous: the server at the other end receives the visitor's IP address, user agent, and usually the referring page URL. Courts and regulators in Europe have treated the automatic transfer of an IP to a third party service as a disclosure requiring a basis, most famously in a German case over hosted fonts that ended with damages for a single font request. Agree with that reasoning or not, it is applied law in places your visitors may live. The design conclusion is simple: every third party your page contacts on load should be a deliberate choice, not an accident of a convenient embed code.
Enumerate the first load honestly
Open your key templates in a browser with an empty profile, open the network panel filtered to third party domains, and reload with the banner untouched. List every external host contacted before any interaction. The usual census: font hosts, tag managers, video platforms fetching thumbnails or player code, map tiles, captcha services loading on page view rather than on form submission, chat widgets, A/B tools, and the consent platform itself, which sometimes loads a surprising number of its own assets from partners. Repeat on a phone over a throttled connection, and repeat after accepting and after rejecting, saving all three lists; they are the raw material of your data flow record.
Fixes, from self hosting to facades
Fonts are the easiest win: self host them, which also removes a render blocking third party hop. Videos and maps convert well to facades, a static image or styled placeholder in the page that loads the real embed only on click; visitors lose nothing they notice and the third party hears nothing until asked. Captchas should initialize on form interaction rather than page load where the vendor allows. Social content belongs behind the two click pattern as a rule. Each fix replaces an automatic disclosure with an intentional one, and the page speed improvement is a genuine bonus you can report to whoever holds the performance budget.
What remains, and documenting it
Some pre consent contact is necessary or justified: the consent platform itself, security services protecting the page, strictly functional infrastructure. The audit's job is to make the list short, known, and defensible, with a written reason per remaining host. File the three request lists from your audit with dates, and rerun the exercise after theme changes and new embeds, which is when quiet disclosures creep back. The banner governs the trackers you chose; this audit governs the ones your templates chose for you.
Related reading
These earlier guides cover connected questions in more depth: Social Media Embeds and Consent: Two-Click Loads, and What the Like Button Already Knows, Review and Ratings Widgets: The Quiet Trackers Under Every Product Page, and Quizzes and Calculators as Lead Tools: Consent for Interactive Embeds.
Frequently asked questions
We use a consent banner, so are pre consent requests covered?
The banner governs the tools wired into it. A font or embed that loads independently of the banner is not covered by it, however good the banner is. Coverage is determined by the actual request list, not by the presence of a banner on the page.
Is self hosting fonts difficult?
No. Download the font files in modern formats, serve them from your own domain with proper caching, and reference them in your CSS. It is an afternoon's work for most sites and it removes both the disclosure and a third party dependency from your most visited pages.
Do click to load facades hurt engagement with videos?
Publishers who measure it usually find a small drop in casual plays and no meaningful loss in intentional viewing. The facade can carry the real thumbnail and title, so the content still advertises itself; only the third party code waits for the click.
What about the consent platform's own requests?
Scrutinize them too. The platform needs to load its script and configuration, but it should not be contacting advertising or analytics partners in the process. Put the question to the vendor directly and keep the answer with your audit records.