Consent theatre (composite)
Scan rule · RSC-PRV-027
- Privacy (GDPR)
- Severity: High
Summarises the case where a banner with a reject option exists and consent-dependent services load anyway — before the decision or after clicking “reject”.
Scan tier
- External scan (anonymous)
- Browser runtime
How to fix it
Gate every consent-dependent script on the consent decision and verify both cases (before the decision, after “reject”) in a fresh browser profile.