Cookie consent mechanism is present
Why it matters
GDPR Article 7 and the ePrivacy Directive Article 5(3) require affirmative, informed consent before setting non-essential cookies or activating tracking scripts for EU users. Loading Google Analytics, Mixpanel, Hotjar, or any advertising pixel without prior consent is a direct ePrivacy violation — not a gray area. Supervisory authorities across the EU have issued fines in this category ranging from four figures for small sites to multi-million-euro penalties for larger operators. CCPA §1798.120 adds opt-out requirements for California users. Most vibe-coded projects wire analytics unconditionally in app/layout.tsx without ever implementing a consent gate.
Severity rationale
High because unconditional analytics loading violates the ePrivacy Directive and GDPR Art. 7 for any EU visitor, with documented regulatory fines even for small operators.
Remediation
Gate analytics initialization behind a consent check. Show a banner on first visit; only load tracking scripts after the user accepts.
// components/cookie-banner.tsx
// Render on first visit; write consent decision to localStorage or a first-party cookie.
// Only initialize analytics after consent === 'accepted'.
The minimal compliant approach: render a banner with Accept/Decline on first visit, persist the choice in a first-party cookie, and conditionally load tracking scripts only when accepted. Libraries like react-cookie-consent handle the banner; wrap your analytics <Script> tag in a conditional. If your project genuinely uses only essential cookies (auth session, CSRF tokens), document this explicitly in your privacy policy — you do not need a banner.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Pre-Launch Checklist Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 7 — Conditions for consent
- eprivacy · Art. 5(3) — Confidentiality of communications — cookie consent requirement
- ccpa · §1798.120 — Right to opt-out of sale of personal information
Taxons
History
- 2026-04-18·v1.0.0·Initial import from pre-launch·automated