Who Got There First?

The link came from an advertisement, one of those you see while scrolling through your Whatever feed. Not a search result, not a bookmark but a sponsored post in a feed, the kind you tap without quite deciding to.

The page loads, you have not clicked anything yet, the cookie banner slides up a moment later and then sits there untouched for ten seconds, because the point of the exercise was to sit still and watch what happens when a visitor does nothing at all.

The network log for those ten seconds runs to several hundred entries.

At 18:58:36, five requests go out to an affiliate network and two domains related to it. One of them sets a cookie with a one year lifetime: The consent platform, the piece of software whose entire job is to decide whether any of that is permitted, finishes loading at 18:58:37.

One second later.

Nobody has agreed to anything, nobody has refused anything since there was nothing to refuse yet, because the mechanism that collects the refusal was still loading while the tracking it governs had already finished.

Then a second run, clean browser, same arrival, and this time the banner gets a click on Refuse. The choice registers correctly and most of the site obeys it at once, but the affiliate tags do not, they go out again on the next page, and the one after that, and every page through to the checkout, renewing the cookie each time.

Then a third run. Accept everything, then open the preferences panel and withdraw it. The withdrawal registers correctly too and on the very next page the advertising pixels stop, but the affiliate tags keep going.

Somewhere in an office, that site has been described as compliant.

What is the word claiming?

Compliant is a relation, a system on one side, a rule on the other, and then asserts that the first satisfies the second.

Which should make it the easy word in this vocabulary, it has a real external referent. There is an actual text, with articles and paragraph numbers, and a regulator who reads it for a living; if a word ever had a fact of the matter behind it, is it not this one?

So why does the answer never come back in the shape of the question?

Ask whether a site is compliant and listen to what arrives: “We have a banner”, “We use a consent platform”, “We had a lawyer review the policy”, “We did the training”… every one of those is true, and not one of them is a relation between a running system and a text. They are objects and some of them have invoices.

When did the purchase become the proof? And if the banner is the evidence, what exactly is it evidence of, beyond the fact that somebody bought a banner?

What loaded before the rule?

The ordering is the whole thing, and it is not a quirk of one website.

A commercial site is assembled over years by people who never meet. Someone adds an analytics snippet in year one because the marketing ased. A contractor adds an affiliate tag in year two, because affiliate revenue was that quarter’s priority and the tag is four lines dropped into a template. A campaign in year three needs a pixel, and the pixel goes in the same file, which by then has been edited by a dozen hands.

Then the rules tighten, or the lawyers get nervous, and the company buys a consent platform, it gets installed the way all of it got installed, as one more script in the same layout file.

That script now carries a job description that runs backwards in time, tt is supposed to govern tags placed before it existed, by people who have since left, for campaigns that ended. How would it?

A script that loads at 18:58:37 has no authority over a request that left the browser at 18:58:36, not because it is badly written, but because it was not there.

Would you expect a rule published on a Tuesday to govern what happened on the Monday? And when the rule is a script tag, what would enforcement even consist of?

It was only ever in a position to control what came after it, placed by people who knew it had arrived.

What was done correctly?

This is the part that makes the finding interesting rather than merely embarrassing, so it is worth being exact about it.

The banner on that site is built properly, refuse and accept sit at the same visual weight, which is the thing regulators have been issuing fines over for years; nothing is pre-ticked; there is a granular panel behind a link, with real categories in it; the withdrawal path works and is reachable from the footer of every page.

Analytics respects the choice, the large advertising pixels respect the choice, every one of them, immediately, on refusal and again on withdrawal. Somebody configured that platform carefully and it does exactly what it was configured to do.

Whoever signed off on that implementation was not lying and was not cutting corners. They were looking at the control panel of the consent platform, where every category showed as correctly configured, and every statement on that panel was true.

Of course, the panel cannot show you what loads before itself.

What does your own scanner say?

There is a second finding on that site and it is much quieter than the first.

The published cookie policy was last revised three years ago and describes around thirty cookies, meanwhile, the consent platform publishes a live declaration on the same domain, generated by crawling the site on a schedule, and that declaration lists more than a hundred. Nine advertising companies that receive data through cookie syncing appear in neither document. How would anyone inside that company find out? Which of the two numbers would they have believed?

So the site publishes two descriptions of itself that contradict each other, side by side, under the same domain name, and has done that for three years. One of the two is maintained by a scanner that runs continuously and costs money every month. It has been producing an accurate inventory the whole time, in public, directly beside a policy that disagrees with it.

Nothing is hidden here. The evidence is not in a log that needs a subpoena or a forensic image, it is a simple URL.

So who was supposed to read it? Whose job was that, on the org chart you could draw from memory? And if the answer is the data protection officer, when was the last time anyone sent them a diff?

Why is the retrofit always late?

Step back from cookies, because cookies are only where this happened to be visible.

Every control you have ever added to a working system was added after the system.

Your linter arrived at four hundred thousand existing lines, and the first thing it did was write a baseline file, a long and quiet list of everything it has agreed never to mention again.

The review process arrived at a team that had already shipped for three years, and it governs the next pull request and never the previous six hundred.

The architecture decision record starts at number one on a system already running in production, which means the decisions that actually determine what you can build were taken before anybody was writing them down.

Your dependency scanner is the same story, it reports on what it can resolve, and the transitive thing pinned four years ago by a developer now at another company sits underneath, resolving fine, flagged by nothing. Is that a clean report, or an incomplete one? What would the difference look like from where you are sitting?

Each of those controls is genuinely useful. Each governs forward from the moment it arrives. And in every single case, the thing it was bought to fix is upstream of its own existence.

So the control reports green, and it is telling the truth about the part of the world it can see. How much of your system is in the baseline file? When did you last open it?

Where does this break?

“You cannot govern what boots before you” is a satisfying sentence and it excuses considerably more than it should. The consent platform does not have to load second. Script ordering is a solved problem, tag managers exist precisely so that tags can be held until a signal arrives, and the platform in question ships documentation explaining how to do that.

The one second is not a law of physics. It is a thing nobody checked.

Which makes the honest version of this less elegant than the tidy one: the ordering made the failure likely, not inevitable, so somebody could have opened the network panel on their own site, for two minutes, on any morning in three years, and the whole thing would have been visible immediately.

A regulator will not accept “it was already in the template”, and is right not to. The late retrofit explains how the gap got there, but it is not a defence, and reaching for it as one would be the same move as pointing at the purchase of that banner.

What has nobody read since the day it shipped?

The company in question is not careless. It has a data protection officer, a named human being with a postal address, it pays for consent tooling every month, its terms were written by somebody who clearly understood the consumer code.

It also has, published on its own domain, this morning, a document generated by its own software that contradicts the document sitting next to it. Both are public. Both have been public for three years. The gap between them was never a secret, and it survived because reading your own published output is nobody’s ticket.

So before the next audit, before the next questionnaire with a column for Yes and a column for No, is there a cheaper question available?

What is published on your domain right now that nobody has read since the day it shipped? Is it the README describing a build process you replaced two years ago? The runbook carrying the pager number of somebody who left? The API documentation for the version before last, still the first thing a customer finds when they search?

Your controls are all reporting green, and they are telling the truth about the part they can see.

What got there before them, and who was in the room when it did?