Consent mechanism where required

What this means

When your site loads analytics, visitors in regions that require consent see a control that lets them accept or decline, and the analytics tool is told the answer. Passing means a consent banner, a consent-mode call or a cookie-consent script is present alongside the analytics tag. Not passing means tracking starts for everyone with no way to decline, which matters if EU or UK visitors reach the site.

How we test it

This check runs only when the analytics check found a tag on your home page. We fetch the page, following at most 3 redirects, and look in the HTML for a consent banner, a gtag("consent", ...) call, or a cookie-consent script. Any one of those present passes. None found is reported as info, not a failure, because whether you need one depends on where your visitors are.

Why it matters

A consent mechanism is required for EU and UK visitors when tracking is on. The Fix Kit's default is Consent Mode v2 with storage denied in the EEA and UK regions until the visitor accepts and granted everywhere else, which is required for EU traffic if you run Google Ads and harmless otherwise. The kit's order is fixed: the consent default is set before the analytics config line, so that the first page view already respects the visitor's region.

The fix

Keep the consent defaults that templates/analytics.js sets before gtag("config", ...), with REQUIRE_CONSENT_REGIONS listing the EEA and UK codes (or [] if you have no visitors there), and add a small banner of two buttons shown when localStorage.getItem("lp_consent") is unset, where Accept calls LP.analytics.grantConsent() and Decline stores "denied" and does nothing else. Then confirm in a private window that window.dataLayer[0] is the granted default, window.dataLayer[1] is the region-scoped denied default, and a ["consent", "update", ...] entry appears after Accept. The full runbook is in the Fix Kit, Module 06.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything yet. This is a verification pass only.
Run: curl -s https://YOUR_DOMAIN/ | grep -oE "G-[A-Z0-9]{6,12}|googletagmanager.com/gtag/js|plausible|posthog|fathom" | sort -u
Confirm analytics is present; if nothing prints, say so and stop here.
Run: curl -s https://YOUR_DOMAIN/ | grep -oiE 'gtag\("consent"[^)]*\)|consent|cookie' | sort | uniq -c
Tell me whether a consent-mode call, a banner, or a cookie-consent script is referenced from the home page.
Search the repo for lp_consent, grantConsent and REQUIRE_CONSENT_REGIONS and show me the file and line for each hit.
List what it would take to show a consent control to visitors in consent regions, without editing anything.
Verify: the grep for consent shows a gtag consent call or a banner reference; if it shows neither, report that no consent mechanism exists and stop.