Scan rule · RSC-PRV-027
Consent theatre (composite)
Privacy (GDPR)Severity: High
Summarises the case where a banner with a reject option exists and consent-dependent services load anyway — before the decision or after clicking “reject”.
Scan tier
External scan (anonymous)Browser runtime
How to fix it
Gate every consent-dependent script on the consent decision and verify both cases (before the decision, after “reject”) in a fresh browser profile.