Privacy and Consent Compliance
for Ad Tech Stacks

Most privacy work on websites stops at the banner. In ad tech the harder part comes after the click, and it is where most problems hide. A choice has to travel from the consent management platform to the tag manager, the ad server, header bidding wrappers, SSPs and every pixel those partners add. If any step drops or rewrites the signal, the visitor's choice is no longer respected, even though the banner looks correct and the consent report shows a healthy opt-in rate.

That is why we treat this as a technical audit. We look at the frameworks your stack uses, such as the IAB Transparency and Consent Framework and the Global Privacy Platform, and at how Google Consent Mode and Google Ad Manager settings read those signals. Whether a given setup meets a specific law is a question for your own legal advisers, and we say so in every report we write.

Consent leakage means a request that should not have happened under the visitor's choice. Common causes are tags hard coded outside the tag manager, vendors added without a consent rule, and third parties that load further third parties. Static reviews rarely catch these, because the calls only appear at runtime and often only on some pages, in some regions or for some device types.

Our audit uses real browser sessions across templates, devices and regions you choose. We decline consent, reload, and log every network call, cookie and storage write. Each finding names the page, the request, the vendor and the likely owner, so fixes do not stall while people search for who is responsible. The same method extends to a wider ad tech stack audit when you want the full picture.

Publishers need their CMP, wrapper and ad server to agree, because a bad signal can reduce the demand that bids on an impression. We check how consent strings reach SSPs, how requests behave for visitors who refuse, and whether revenue differences by region trace back to a configuration fault. Advertisers and agencies have a different exposure: their own pixels, conversion tags and creative-served trackers.

For agencies, we also check creative and tag behavior inside delivered ads, which connects to our ad quality and compliance work. Both groups get a written record of what was tested, what failed and what changed, which supports internal governance and gives auditors a clear trail to follow. For the broader service area, see ad tech services, where consent work sits next to tag and platform support.

This is an example of format, not a real result. Page: article template. Test: decline all in the consent banner, then reload. Finding: a measurement pixel from a third-party vendor still fires before consent. Evidence: network log with request URL and time. Owner: tag manager administrator. Suggested fix: block the tag until consent is given and retest.

A review report lists items like this one, with the page, vendor, request and owner, so the right team can fix them.

The audit starts with a test plan. You receive:

• A list of pages and flows to test, in the regions you operate.

• A test log of accept, decline and withdraw sessions, with requests, cookies and storage recorded.

• A findings report ranked by risk, with owners.

• A retest after fixes.

Check that: the banner works on desktop and mobile; declining blocks non-essential tags; consent signals (TCF string or GPP) pass to vendors; Google Consent Mode is set up as intended; and withdrawing consent works.

For publishers, include bidders and SSPs. For advertisers, include pixels, tag managers and landing pages. We describe technical behavior and leave legal interpretation to your counsel.