Consent Mode HQ

CISA lists Node2Shell (CVE-2026-111497) as exploited, with a 10 November deadline. Google's server-side GTM image got patched Node.js on 29 October, but Cloud Run keeps the old image until you…

The CNIL fined Fnac Darty €7 million because its app's product-recommendation engine kept tracking users who tapped 'Continuer sans accepter'. Fnac said recommendations were strictly necessary; the CNIL said no.…

On 29 October 2026 Binance lost $6.3 billion and a hijacked monitoring script drained Polymarket users. Why the second one is a consent story, why Consent Mode does not block…

PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on PHP servers. On most WordPress sites the cookie banner, its blocking and the consent records live on that server, and external scripts…

At the 14 October 2026 Supreme Court argument in Salazar v. Paramount, justices called consent the easy fix for VPPA pixel cases. Paramount's counsel said VPPA consent is stricter than…

Google Ads Help changed 'by default, consent will be denied' to 'defaults to a consented state' in mid-2026, while its own table still says denied. Without a default we measured…

Since 8 October 2026, GTM snippets initialise on load regardless of gtag('config'), and config calls surface as gtag.config dataLayer events that can fire wildcard triggers. Who is affected and the…

Silktide's open-source Consent Manager sends Consent Mode updates but no default. Set up as the README shows, GA4 fired a page_view with no consent signal and set _ga before any…

On 14 October 2026 the Supreme Court hears Salazar v. Paramount: does a newsletter subscriber count as a VPPA 'consumer' when a site's Meta Pixel shares the videos they watched?…

Connecticut settled with TaxAct over Meta and Google tags that sent taxpayers' financial data. Beyond $275,000, it requires a tag review committee, data-point records, regular tag-monitoring scans and two independent…