# Prior Blocking: The Tags That Must Not Fire Before a Choice Exists

Source: https://cookiebastion.com/blog/2026-11-04-prior-blocking-tags-before-consent.html

[Home](../index.md) / [Blog](index.md) / Server Side Tagging and Consent: Keeping the Signal Intact


Published 2026-11-04

Prior blocking means non essential scripts, pixels, and embeds stay unloaded until the visitor chooses. It fails in predictable places: video and map embeds that call home on page load, tag manager tags with page view triggers, and scripts a developer added directly to the template outside any consent control.

## Embeds are the usual breach

A YouTube embed, a map, a social feed widget: each loads from a third party server the moment the page renders, sets or reads identifiers, and reports back, all before any banner interaction. The page owner often does not think of an embed as a tracker, but the network does not care about the owner's mental model. The request left the browser and the data moved.

The fixes are known and mostly cheap. Facade embeds that load a static preview and fetch the real player only after a click, or after consent where the embed is marketing rather than function. Privacy enhanced embed modes that reduce, though do not eliminate, the data sent. And for maps, a static image that links out often serves the visitor as well as the interactive frame did.

## The template scripts nobody owns

Every mature site carries scripts added straight into templates during some past urgency: a chat tool from a trial, a heatmap from an experiment, a pixel from a campaign that ended two years ago. They sit outside the tag manager, so the consent audit of the container never lists them, and outside anyone's memory, so the vendor inventory never lists them either. The network recording lists all of them, which is why it outranks every document in this audit.

Work from the recording inward. List every third party host contacted with consent denied, then assign each an owner and a purpose, or a removal date. Hosts nobody can explain get removed first and explained afterward if anyone complains, which they rarely do. [Consent State Across Subdomains: Where the Shop, Blog, and Support Site Disagree](https://cookiebastion.com/blog/2026-11-03-consent-state-across-subdomains.md) walks through the denied state test in full.

## What good blocking looks like technically

Consent dependent resources are held by the consent tool or the tag manager with denied as the default state, and they load on the consent update event, not on a timer and not on scroll. Scroll based loading deserves its own warning: treating scroll as implied consent has been rejected by regulators, and a tag that fires because the visitor moved down the page is a tag that fired without a choice.

Test the full matrix before sign off: first visit denied, first visit accepted, returning visit with a stored refusal, and the same four on a phone. Prior blocking that only works in the first cell is a demo, not a control, and the stored refusal cell is the one that catches teams out quarter after quarter.

Keep reading: [Consent State Across Subdomains: Where the Shop, Blog, and Support Site Disagree](https://cookiebastion.com/blog/2026-11-03-consent-state-across-subdomains.md) [Reading a TCF Consent String When a Partner Says You Sent the Wrong One](https://cookiebastion.com/blog/2026-11-03-tcf-consent-string-debugging.md) [Top Cookiebot Alternatives Worth Switching To](https://cookiebastion.com/blog/2026-11-02-cookiebot-alternatives.md).

## Frequently asked questions

### What does prior blocking actually require?

Non essential cookies and trackers must not load until the visitor has consented. That covers scripts, pixels, and embeds, not just cookies set by your own code. If a third party request leaves the browser before a choice, prior blocking has failed for that resource.

### Are video embeds really a consent problem?

Yes. A standard video embed contacts the provider's servers on page load and can set identifiers before any interaction. Click to load facades or consent gated embeds solve it: show a preview image, load the player only on click or after consent, and the page keeps its design without the early data flow.

### Is firing tags on scroll a valid consent signal?

No. Regulators have rejected scroll and continued browsing as consent, because neither is an unambiguous affirmative action for specific purposes. Tags must wait for an actual choice recorded by the consent tool, not for a behaviour that might just mean reading.

### How do I find scripts outside the tag manager?

Record network requests in a fresh profile with consent denied and list every third party host. Compare that list against the tag manager export and the vendor inventory. Anything on the network list and nowhere else was added directly to templates or by another tool, and it needs an owner or a removal date.