# Cookie consent banner displays on first visit before non-essential cookies are set - **Pattern:** `ab-000795` (`cookie-consent-compliance.banner-ux.banner-first-visit`) - **Severity:** critical - **Lifecycle:** active - **Last modified:** 2026-04-18 - **Canonical URL:** https://auditbuffet.com/patterns/ab-000795 - **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000795) ## Why it matters ePrivacy Art. 5(3) prohibits storing information on a user's device without prior informed consent. When analytics and ad pixels fire on page load before a consent banner appears, every first visit becomes an unlawful data collection event. Regulators — the CNIL, ICO, and Austrian DSB — have each issued fines specifically for this ordering failure, not for lacking a banner entirely. The business risk is not theoretical: a single DPA complaint can trigger an investigation across an entire platform. ## Severity rationale Critical because a mis-ordered load sequence violates ePrivacy Art. 5(3) on every first page view, exposing the operator to per-visit regulatory liability before any user interaction occurs. ## Remediation Render the consent component at the top of the root layout and move all non-essential scripts into its post-consent callback. In Next.js App Router, no `