# Non-Google tags Most non-Google tags ignore Google's consent state. Two exceptions change what you test: Microsoft UET reads Google's consent state automatically unless `enableAutoConsent: false` is set, and some Community Template Gallery templates read consent through the template APIs (`isConsentGranted`, `addConsentListener`). Check each vendor and each template rather than assuming. Every vendor is controlled in one of three ways, and the test differs for each: - Not loaded until consent (GTM "Require additional consent", a blocking trigger, or CMP blocking). Test: no request and no cookie from the vendor before the choice. - Loaded with the vendor's own consent API. Test: the API is called before the vendor's first event on every page, and what it holds or releases matches the specification. - Loaded with no control. In an opt-in region this is S1. Vendor APIs below were checked against the vendors' own pages on 2026-10-17. ## Meta Pixel - Meta's GDPR page for the pixel: call `fbq('consent', 'revoke')` before `fbq('init', ...)`, call revoke on every page, and call `fbq('consent', 'grant')` once consent is given. Meta describes revoke as pausing pixel fires. - Not documented: whether events tracked while revoked are dropped or sent when grant is called. Test it: load a page while revoked, grant, and check whether a PageView with the earlier page's details is sent. Compare with the specification. - A GTM tag that loads the pixel base code on All Pages with "Require additional consent" never fires on the acceptance page unless it also has the CMP's update trigger. - Withdrawal on the same page (C7): blocking the tag in GTM does not stop a pixel library that already loaded. After withdrawal, no Meta request may follow, including automatic events such as button-click or page-metadata events (read the event names in Meta's extension or the HAR). An automatic event after withdrawal means `fbq('consent', 'revoke')` did not run: S1. - Evidence: pixel requests (filter the Network panel on `facebook.com/tr`), the `_fbp` and `_fbc` cookies, and Meta's browser extension, formerly Meta Pixel Helper and now Meta Ads Data Advisor, which lists each event and its parameters. The extension can also apply fixes with your approval; use it to read only. Events Manager Test Events shows the same browser's events arriving. - Server events (Conversions API) need the same consent gate on the server. That path belongs to the meta-capi-setup and server-side-tracking-debug skills; if neither is installed, record the server path as not covered in the write-up. - Meta's Ads MCP server: the read tools are useful for comparing event volume before and after a fix (`ads_get_datasets`, `ads_get_dataset_details`, `ads_get_dataset_stats`, `ads_get_dataset_quality`, `ads_pixel_event_read`, `ads_pixel_parameter_read`, `ads_get_customconversions`). Never call `ads_pixel_event_create`, `ads_pixel_event_update`, `ads_pixel_event_delete`, `ads_pixel_parameter_create`, `ads_pixel_parameter_update` or `ads_pixel_parameter_delete` from this skill. ## TikTok Pixel From TikTok's "Pixel Cookie consent mode" developer page: - Default opt-out: add `holdConsent`, `revokeConsent` and `grantConsent` to the `ttq.methods` array in the base code, and call `ttq.holdConsent()` before `ttq.load()`. Events are queued, not shared. - `ttq.grantConsent()` shares events, including those queued earlier in the session. - `ttq.revokeConsent()` stops sharing, including queued events. It does not affect data already sent. - Default opt-in: load normally and call revoke or grant as the visitor chooses. - TikTok says to implement it on every page with the pixel. - Traps: - Releasing queued pre-consent events on grant is TikTok's documented behaviour. If the specification says events before a choice must be dropped, holdConsent is the wrong pattern; do not load the pixel until consent. - An older base code without the three names in `ttq.methods` has no stub for them, so early calls fail. Check the snippet and the console for errors. - TikTok also offers a first-party cookie toggle in the pixel settings in Events Manager; it changes cookie behaviour, not consent. - Evidence: event requests to `analytics.tiktok.com/api/` (the library loads from the same host under a different path, so count events, not the host), and TikTok's Pixel Helper Chrome extension for per-event diagnostics. ## LinkedIn Insight Tag - LinkedIn's Insight Tag FAQ (checked 2026-10-17) documents no consent API, consent mode or JavaScript consent call for the tag. Control it by not loading it until marketing consent is granted. - Check LinkedIn's current documentation at run time in case a consent signal has been added since. - Evidence: no LinkedIn requests or cookies before the choice; read cookie names from the CMP scan report. ## Microsoft UET From Microsoft Advertising's "Setting up UET for Consent Mode", and Microsoft's `bat.js` read on 2026-10-17: - Consent is set through `ad_storage` with `window.uetq.push('consent', 'default', {...})` and `window.uetq.push('consent', 'update', {...})`. Microsoft recommends the consent script in the head and an update on every page while the choice applies. - Denied: UET first-party cookies are neither read nor written, and third-party cookies are not written. - If no default is set, UET treats consent as granted in most countries. Where Microsoft enforces consent mode (EEA, UK, Switzerland) the default is denied, and conversions are lost if the granted update is never sent. - UET reads consent from other sources automatically: Google's consent state (from `google_tag_data.ics`, so a Google consent update can drive UET with no UET code) and TCF. `enableAutoConsent: false` in the tag turns the Google source off. Check it before deciding which source you are testing, and record which source set the state. - Setting the `_uetmsdns` cookie to `1` stops UET sending events. - Evidence: - `asc=D` or `asc=G` on event requests (UET Tag Helper shows denied or granted). Before consent or after a reject: `asc=D` or no UET events. After a grant: `asc=G` on every later event. - Updates taken from Google's consent state also produce a `gtmConsent` beacon with `gasc=G` or `gasc=D`. - Denied and before-load beacons go to `bat.bing.net`. Filter on `bat.bing.` to see both hosts. - The Consent Signal column on the UET tag page confirms the pattern days later. ## Microsoft Clarity - Clarity's consent is separate from UET, even when the two are integrated. Clarity's ConsentV2 API takes `window.clarity('consentv2', { ad_Storage: ..., analytics_Storage: ... })`; verify the call on Microsoft's Clarity consent page at run time. - Without consent, Clarity runs in a no-consent mode with no Clarity cookies and an ID per page view. If Clarity loads ungated, Clarity requests after a reject are expected; whether that is allowed is a specification decision. Test for: no `_clck` or `_clsk` cookie (Clarity's first-party cookies) before a grant or after a reject, and the CMP sending the ConsentV2 call on every choice. ## Product analytics - Mixpanel (JavaScript SDK): - `mixpanel.opt_out_tracking()` sets a flag in a cookie or localStorage and stops sending data. `mixpanel.opt_in_tracking()` sets the flag back and sends an `$opt_in` event. `opt_out_tracking_by_default: true` in `init` starts everyone opted out. - The opt-out persists until that cookie or localStorage entry is cleared. A CMP withdrawal that deletes Mixpanel's storage can delete the opt-out flag too and resume tracking. Test withdrawal followed by a reload. - Client opt-out does not affect server-side events. - Amplitude (Browser SDK 2): - `optOut: true` in the configuration stops tracking and upload for that `init` call; the site must pass it on every page load. - `setOptOut(true)` at run time disables logging for the user, and Amplitude documents that this setting persists across page loads. - `identityStorage: 'none'` stops persisting identity. - The SDK dispatches events tracked before initialisation once `init` runs. If the site defers `init` until consent but calls `track` earlier, pre-consent events are sent after the grant. - PostHog: - `posthog.opt_out_capturing()`, `posthog.opt_in_capturing()`, `posthog.has_opted_out_capturing()`; `opt_out_capturing_by_default: true` in `init`; `opt_out_capturing_persistence_type` set to `localStorage` or `cookie`. - `cookieless_mode: 'always'` never stores PostHog data in cookies or storage and counts users with a privacy-preserving hash computed on PostHog's servers. - `cookieless_mode: 'on_reject'` captures no events until the visitor gives or denies consent. After a reject PostHog still loads and keeps counting the visitor with that server-side hash, so expect cookieless PostHog requests after C1 and no PostHog cookie or storage. Whether that is allowed is a specification decision; put it in the matrix row. - Both cookieless modes need "Cookieless server hash mode" enabled in the PostHog project settings. Confirm it with the PostHog owner. - For Mixpanel, Amplitude and PostHog outside `on_reject`: check that the CMP actually calls the opt-out method on reject and withdrawal. Deleting the vendor's cookies is not the same as opting out. - Reverse proxies are common for PostHog and Amplitude. Read the proxy host from `stack.md` and add it to the snapshot script and the HAR extractor before counting requests. ## Embeds, replay and chat - Video players, schedulers, chat widgets, session replay and A/B testing tools set their own cookies, often in iframes and often after a delay or a scroll. - Exercise each on its real route in C0, C1 and C7. A homepage pass says nothing about a scheduler on the demo page. ## Server-side destinations - Google's server-side consent guide: the Google tag passes consent to the server container as request parameters, a GA4 client must receive it, and Google product tags in the server are consent-aware. - Google does not document non-Google server tags as consent-aware. A Meta, TikTok or LinkedIn server tag must read the consent state from event data and be blocked explicitly. - Moving a request to your own domain or server does not change the consent requirement. - Diagnosis of the server hop belongs to the server-side-tracking-debug skill. If it is not installed, record the server hop as not covered in the write-up.