The Cookie Banner on the Login Page: Consent Before the Account Exists
The login page is the most tracked page on most sites and the last one the consent team thinks about. Analytics, error tracking, a chat widget, and a fingerprinting script all fire before the visitor has typed a character, because the page needs them to work. The visitor has no account yet, no choice recorded, and no reason to expect the tracking. The banner belongs on the login page first, not last, because the login page is where the identity is built.
The pattern is easy to miss because the login page feels like plumbing. It is not a marketing page, it does not carry the banner in the mockups, and the team that owns it is the identity team, not the privacy team. But the login page is where a pseudonymous visitor becomes a known consumer, and that transition is exactly what the consent rules care about. California's regulation says an opt-out preference signal covers the consumer, including the account, once the consumer is known. The login is the moment the consumer becomes known.
What fires before the choice
Walk the login page with the network tab open and a cleared profile. The analytics tag fires on page view. The error tracker fires on load. The chat widget loads its script and fingerprints the browser before the visitor says hello, which is the same pattern as the chat-widget problem on the homepage, only earlier in the journey. A fingerprint collected before consent is a fingerprint collected without a lawful basis, and the login page is where the fingerprint is most valuable, because it is about to be tied to an account.
The fix is the same as everywhere else: block the tags until consent, and treat the login page as a first-class page in the CMP configuration instead of an exception. The CMP has to load before the tags, the defaults have to be denied, and the stored choice has to be read before anything fires. If the CMP tag loads late, consent defaults to whatever the tags do on their own, which is everything.
The account-level record starts here
The login page is also where the consent record should gain its stable identifier. A choice recorded only in a browser cookie is a choice that dies with the cookie. A choice tied to the account at login survives the device, the browser, and the cookie clear. That is the record the regulation wants: identifier, timestamp, purposes accepted and rejected, banner version, method, and jurisdiction, attached to the account the moment the visitor logs in.
This is also where the GPC signal has to be honored for the account. A visitor who opted out through GPC on one device and logs in on another has opted out as a consumer, not as a browser. The login is the moment the site learns who they are, and the opt-out has to follow the account from that moment. A CMP that only checks the cookie at login will miss it.
The test to run this week
Clear your profile, load the login page, and count the tags that fire before you click anything. Then log in, check whether the consent state moved from the cookie to the account, and confirm the record carries the account identifier. If the tags fired before consent, or the record still points at a cookie, the login page is the gap. Fix it before the checkout page, because the login page is earlier in the journey and the identity is built there.
Keep reading: Your Banner Lists 12 Trackers. Your Site Runs 40: The Cookie Audit Gap, The Thank-You Page: Post-Purchase Tracking and the Consent It Forgot, What Happens to Consent When a Visitor Clears Cookies cover the nearby cases in this series.
Frequently asked questions
Does the cookie banner need to appear on the login page?
Yes. Tracking fires on the login page before the visitor has an account or a recorded choice, so the banner and the blocking have to cover it like any other page. A login page left out of the CMP configuration is a gap, not an exception.
What trackers usually fire on login pages?
Analytics tags, error trackers, chat widgets, and fingerprinting scripts commonly fire on page load, before the visitor types anything. A chat widget that fingerprints the browser before hello is the same problem as on the homepage, only earlier.
How does consent work when the visitor logs in?
The choice should move from the browser cookie to the account at login, so it survives the device and the cookie clear. The record needs the account identifier, timestamp, purposes, banner version, method, and jurisdiction.
Does a GPC opt-out follow the account after login?
Yes. Under California's rules a valid opt-out preference signal covers the consumer, including the account, once the consumer is known. The login is the moment the site learns who the visitor is, and the opt-out has to follow from there.