Tracking & attribution engineeringClient work
A read-only consent audit — Consent Mode v2 defaults, competing CMPs, US opt-out and GPC — followed by the fix, with a verdict in both reject and accept states.
Sounds familiar?
How I solve it
I build a read-only consent audit first, then the fix. The audit captures runtime in both the reject and the accept state, on the public container and the consent tool’s config, and reports what fires, under which default, and whether anything fires before a choice — no logins needed. The fix sets Consent Mode v2 defaults per region, wires US opt-out, removes competing consent tools and hard-coded granted states, and re-verifies in both states. This is technical implementation, not legal advice.
The process
6 steps. Scope and a fixed price are agreed before the first one.
Reject and accept, on the public GTM container and the consent configs, without touching your accounts.
Consent Mode defaults and each consent tool on the page.
Pre-ticked consent, granted hard-coded, duplicate defaults, cookies set before consent, and pixels that fire with no choice made.
What fires before consent, what it costs you, and what stays unknown and why.
Consent Mode v2 defaults per region, US opt-out with GPC honoured before any tag loads, competing tools removed.
Re-check both states on the live site and hand over a change record.
Handover
granted-hard-coded states removed where they cause the leak.Built with
Proof
Client work Done for real clients. Client details are anonymised.
Before → after
A consent app switched on an opt-in requirement for about 20 US states, and the requirement survived the app’s uninstall. Proving the cause against a control group: the affected state lost 6 of 11 web orders in the window versus 0 of 25 outside it, and the non-consent states lost 0 of 10 — Fisher p = 0.0002, re-checked on 2026-09-02.
US outdoor-safety / fire-protection Shopify store
root-caused a Meta attribution drop to a consent app's opt-in change across about 20 US states, proved against a control group (p = 0.0002); Meta received 166 purchase events for 108 real orders; tracking recovered to about 96% of baseline.
US headless-Shopify automotive-repair retailer
6% to 76%
US opt-out consent (GPC honoured before any tag loads, opt-out link, no cookie wall) built on a headless store, and refunds subtracted; sales traceable to source 6% → 76%.
Read the case: 16 Days Before Shopify's Deadline: Rebuilding Measurement for a Headless StoreHong Kong design studio, Webflow
5/5
lead tracking rebuilt behind CookieYes consent mode; 5 of 5 written acceptance conditions met.
Read the case: 27 Changes, Each With Its Own Undo: Fixing Lead Tracking on a Site I Never Logged IntoHe provided a fantastic audit with real insights and easy to understand terms for those of us who aren't as technical.
What you can look at
A redrawn consent-state matrix (each tag × reject × accept) on synthetic data, plus a redacted pre-consent network capture showing a tag firing before a choice.
Client details anonymised. Figures read from live reads in August–September 2026. This covers technical implementation, not legal advice.
Price and timeline
The audit is a Tracking Health Check: USD 395, read-only, one site, one agreed problem, up to three agreed systems, with a written verdict two working days after the kickoff and confirmed access. The fix is a separate, bounded Focused Fix from USD 450. If you have a single question, a Working Session is USD 195. This is technical implementation, not legal advice.
QuoteFixed before work starts
A note from Daniilbefore you decide
If your Consent Mode defaults are correct, one consent tool owns the site, and nothing fires before a choice, you don’t need this — I’ll say so. This covers technical implementation, not legal advice; if you are a health provider or another regulated business, have your counsel review what data may be sent before I build anything.
— Daniil
Questions
No. The audit reads the public container and the consent configs and captures runtime in both states. Read-only access only becomes useful for the fix.
No. It is technical implementation: what fires, when, and under which default. What you are permitted to collect is your counsel's decision.
Regions get defaults set per area, and the US gets opt-out — GPC and an opt-out link rather than a cookie wall.
Then we prove it. In the dated case a control-group comparison (p = 0.0002) showed the opt-in change caused it, and that the setting survived the app's removal.
Two working days after the kickoff and confirmed access for the Health Check; the fix is a separate bounded job.
The first answer is free, within one working day. Or write directly: next@taskfordaniel.com