Piwik PRO Loads Before Consent After Updating tarteaucitron to 1.35

This is not a bug in the usual sense. It implements a model Piwik PRO documents on purpose. But it arrives through a version bump, and a site that chose tarteaucitron precisely so that “no consent” meant “no analytics script” now behaves differently without anyone having decided that.

What changed in the code

The change is commit dfd6be3, “Add Piwik consent mode”. Two parts matter. In tarteaucitron.js, the defaults now include:

"piwikConsentMode": true,
"softConsentMode": false,

And in tarteaucitron.services.js, the piwikpro service, which in v1.34.0 had only a js function, gains a fallback:

"fallback": function() {
    if (tarteaucitron.parameters.piwikConsentMode === true) {
        if (tarteaucitron.parameters.softConsentMode === false) {
            this.js();
        }
    }
}

this.js() is the same function that runs on consent: it injects <container>.containers.piwik.pro/<id>.js. And tarteaucitron calls a service’s fallback in two situations — when the service is denied, and on a first visit when the service has no consent yet. So the container now loads in both. With softConsentMode at its default of false, the same release also unblocks /\.piwik\.pro/ in tarteaucitron’s script blocker.

What we measured

A local page loading tarteaucitron from jsDelivr at the tag under test, with the piwikpro service configured, highPrivacy: true, and the consent cookie cleared before each run. A MutationObserver recorded every script inserted whose source matched piwik.pro. Run in Chromium on 23 September 2026:

First visit, banner not touched
  v1.34.0                          no Piwik PRO script
  v1.35.0 (defaults)               container injected at 745 ms
  v1.35.0, piwikConsentMode:false  no Piwik PRO script

After "Deny all cookies"
  v1.34.0                          no Piwik PRO script
  v1.35.0 (defaults)               container loaded

The container request itself carries what every third-party request carries: the visitor’s IP address, user agent and the page they are on.

The model it implements, in Piwik PRO’s words

Piwik PRO’s guide to integrating a third-party consent tool describes the design: “collect full data from visitors who gave their consent and anonymous data from the others”. For the anonymous group it masks the IP address and can group events into sessions using a hash built from “the visitor’s IP address, operating system, browser name and version, browser language, enabled browser plugins, and site or app ID”.

Whether that anonymous mode is acceptable for your site without consent is a legal question that depends on your jurisdiction and your Piwik PRO settings, and we do not answer it here. The technical point is narrower: a hash assembled from browser characteristics is still information read from the visitor’s device, and the argument that “no cookie means no consent needed” is the one we took apart in what a cookie scanner cannot see. The decision should be made deliberately, not inherited from a default.

One detail the integration gets wrong

The same Piwik PRO guide asks for one call at a specific moment: “call the setInitialComplianceSettings() method when the visitor first sees your consent form”. That sets the consent state to “no decision”.

We read the queued calls from window.dataLayer. On v1.35.0, before any answer, it held stg.start and no setInitialComplianceSettings — the container was loaded but the “no decision yet” state was never declared. That call appeared only after the visitor clicked Deny. So on a first visit, Piwik PRO receives a container load with no consent state set, which is not the sequence its own documentation describes.

What Piwik PRO actually does with a container loaded in that state is something we could not test: our container ID was a dummy, so we measured what tarteaucitron sends and queues, not what Piwik PRO records or which cookies it would set.

What to do

1. If you want the old behaviour — Piwik PRO only after consent — set it explicitly:

   tarteaucitron.init({
     // ...
     "piwikConsentMode": false
   });

2. If you want Piwik PRO’s anonymous mode, make it a decision rather than a default: configure the anonymous-data settings in Piwik PRO, disclose it in your cookie policy, and make sure setInitialComplianceSettings runs when the banner is first shown rather than after a refusal.
3. Pin the version if you load tarteaucitron from a CDN without a version number, so the next default change reaches you through a review, not a deploy.
4. Check the other two. googleConsentMode and bingConsentMode are also true by default in this release. We covered the Google side in our tarteaucitron and Consent Mode v2 guide.

To see what your own pages request before a decision, the method is the one we use here, and it is scriptable — a Playwright script for pre-consent tracking does it across a whole site.

A library update can change what loads before consent without a single change to your own code. Scan your site to see every third-party request made before the banner is answered with CookieInspector.