GDPR Excellence
Alignment with Article 32 Security Requirements
GA4 Compliance Checklist
GA4 Zero-State Audit Protocol
Technical methodology to verify cookie consent gate prevents unauthorized data collection. Includes network monitoring patterns, console validation, and library analysis.
Network Monitoring Guide
Monitor Network Tab in DevTools for unauthorized requests. Look for: collect?v=2, config/update, gtm.js before consent, POST to google-analytics.com/g/collect, gtag transmission. Before Accept click is a GDPR violation.
The Zero-State Test
Step 1: Open Incognito/Private window. Step 2: Clear all site data. Step 3: Disable all browser extensions. Step 4: Open DevTools Network tab. Step 5: Navigate to your website. Step 6: Verify ZERO requests to google-analytics.com or googletagmanager.com. Step 7: Check all subresources for any tracking scripts. Step 8: Document initial state screenshot.
Console Commands
Command 1: typeof gtag === undefined (must be true before consent). Command 2: typeof ga === undefined (must be true). Command 3: window.dataLayer === undefined || window.dataLayer.length === 0 (must be empty before consent). Command 4: Object.keys(window).filter(k => k.includes("tag")).length === 0 (no tag objects before consent). Any false result indicates violations.
Library vs. Beacon Analysis
CRITICAL: Loading gtag.js from Google CDN itself transmits client IP address to Google without consent. The script fetch requests are made before any consent logic executes. This may constitute a GDPR breach as IP addresses are personal data under Recital 26. Compliance approach: Use Google Analytics via Measurement Protocol (POST beacons) only after explicit consent, or use privacy-preserving alternatives like Plausible, Matomo, or self-hosted analytics with IP anonymization enabled.
IP Address Leakage Assessment
Script loading from googletagmanager.com/gtag/js and google-analytics.com/analytics.js creates DNS queries and TLS handshakes that reveal client IP to Google servers. Even without firing events, the mere resource loading constitutes data transmission. Audit: Check Network tab initial requests for gtag.js or analytics.js file loads. Verify timing: if loaded before cookie banner appears = violation. Verify DNS: Pre-resolved domains indicate pre-loading.
Final Audit Checklist
Check: gtag.js NOT present in initial DOM; dataLayer is empty array []; No requests to *.google-analytics.com in first 5 seconds; No requests to *.googletagmanager.com in first 5 seconds; Cookie banner is FIRST interactive element; No gtag() calls in source before consent handling; Consent callback actually injects gtag.js (verify timing); Reject option immediately terminates all GA connections; Cookie rejection clears any set cookies; DPA/AVV includes Google as data processor; IP address not transmitted in pre-consent requests; POST beacons only fire after explicit opt-in; Measurable data contains no PII before consent.