This week, I worked with a digital agency that couldn’t understand how their site had LinkedIn cookies and 20+ tracking beacons loading before user consent. They checked in Chrome and Firefox developer tools and saw nothing.
Yet our privacy scan told a different story.
To confirm, we reviewed a HAR file - and there it was: a direct call to LinkedIn’s tracking endpoint (px.ads.linkedin.com) and third-party cookies (bcookie, li_gc, lidc) set before the user had any chance to give consent.
This is a common and dangerous misunderstanding. Modern tracking scripts often load invisibly, and they do it in ways that bypass what most developers see in the console.
<h2>Why Tracking Is Often Invisible</h2>
Tools like Google Tag Manager inject scripts dynamically after the page loads. These scripts may:
<ul>
<li aria-level="1">Be loaded asynchronously</li>
<li aria-level="1">Insert beacons via image or script tags</li>
<li aria-level="1">Set cookies via HTTP headers, not JavaScript</li>
</ul>
Unless you're actively recording all network activity from the start of the page load, these actions will not appear in the console. Developer tools were never designed to detect stealth tracking or enforce privacy compliance.
So while the console may look clean, the browser is often quietly communicating with third-party services in the background.
<h2>The Legal Foundation: ePrivacy Directive 5(3)</h2>
Under Article 5(3) of the ePrivacy Directive, any technology that stores or accesses information on a user’s device - cookies, scripts, pixels, localStorage, beacons - requires prior, informed consent unless it is strictly necessary for the service the user requested.
This principle is not limited to the EU. It is also reflected in:
<ul>
<li aria-level="1">The UK’s Privacy and Electronic Communications Regulations (PECR)</li>
<li aria-level="1">Norway’s EKOM Act</li>
<li aria-level="1">And transposed national laws across all EU member states</li>
</ul>
This means the legal requirement applies broadly and consistently: No tracking - regardless of whether it sets a cookie or other tracking technologies - can happen before consent.
<h2>The Role of Google Tag Manager in Consent Circumvention</h2>
One of the primary enablers of non-compliant tracking today is Google Tag Manager. It allows third-party scripts to be injected on the client side, often without visibility or proper sequencing relative to consent.
GTM is routinely used to load tools from Google, Meta, LinkedIn, Hotjar, TikTok, and other services before consent is gathered, resulting in immediate data collection: IP addresses, page visits, device info, and more.
This data is shared with ad networks and SaaS platforms before users have even seen a cookie banner - let alone clicked "Accept."
It’s become a silent infrastructure for surveillance, and in many cases, agencies and developers don’t even realize it’s happening on the sites they build.
<h2>What Agencies and Developers Must Do</h2>
<ol>
<li aria-level="1">Stop relying solely on developer tools to verify privacy compliance. Use HAR file analysis and purpose-built <a href="https://aesirx.io/services/privacy-scanner" target="_blank" rel="noopener">Privacy Scanners</a> to see the full picture.</li>
<li aria-level="1">Block all trackers by default, and only load them after valid, informed consent is recorded.</li>
<li aria-level="1">Use a first-party compliant CMP that ensures no data leakage to third parties prior to consent. (<a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener">AesirX CMP for WordPress</a> was designed especially for this purpose).</li>
<li aria-level="1">Audit your GTM container - you may be surprised what’s being loaded without your knowledge.</li>
<li aria-level="1">Understand your legal obligations under ePrivacy Directive and GDPR. Privacy is not a UX option; it's a legal and ethical requirement.</li>
<li aria-level="1">Consider <a href="https://aesirx.io/services/privacy-monitoring" target="_blank" rel="noopener">Monitoring your websites and ecommerce solutions</a> to ensure that no new scripts or tracking technologies are added by mistake before consent is given.</li>
</ol>
<h2>The Bigger Issue</h2>
Until we as an industry take this seriously, the web will remain an environment where users are profiled and tracked without awareness or choice. This isn't just about cookies - it's about trust, freedom, and control over personal data.
And it’s time we built differently.
Ronni K. Gothard Christiansen
Technical Compliance Specialist &amp; CEO, <a href="http://aesirx.io" target="_blank" rel="noopener">AesirX.io</a>&nbsp;
If you need help with a full technical privacy review please contact me directly or book it here: <a href="https://aesirx.io/services/privacy-review" target="_blank" rel="noopener">https://aesirx.io/services/privacy-review</a>
<h3>Appendix: ePrivacy Directive Article 5(3) in National Law</h3>
Article 5(3) of the ePrivacy Directive (ePD) requires prior consent for storing or accessing any information on a user’s device — not just cookies. This principle has been transposed into national law in every EU/EEA country, and remains in force in the UK and Norway through equivalent legislation.
Here are examples of how ePD 5(3) and similar legal frameworks is reflected across key jurisdictions:
<div class="table-responsive">
<table class="table table-bordered">
<tbody>
<tr>
<td style="text-align: center;">
Country
</td>
<td style="text-align: center;">
National Law / Regulation 
</td>
<td style="text-align: center;">
Key Consent Principle 
</td>
</tr>
<tr>
<td>Denmark</td>
<td>Cookiebekendtgørelsen (BEK nr. 1148 af 09/12/2011)</td>
<td>Consent required before storing/accessing data</td>
</tr>
<tr>
<td>Germany</td>
<td>TTDSG (Telekommunikation-Telemedien-Datenschutz-Gesetz)</td>
<td>Consent for all non-essential device access</td>
</tr>
<tr>
<td>France</td>
<td>CNIL Guidelines on Cookies and Trackers (2020)</td>
<td>Explicit consent before any tracking</td>
</tr>
<tr>
<td>Netherlands</td>
<td>Telecommunications Act (Telecommunicatiewet)</td>
<td>Prior consent for cookies and similar tech</td>
</tr>
<tr>
<td>Italy</td>
<td>Italian Privacy Code (as amended by GDPR)</td>
<td>Consent required unless strictly necessary</td>
</tr>
<tr>
<td>Spain</td>
<td>Law 34/2002 on Information Society Services (LSSI-CE)</td>
<td>Consent before setting cookies or scripts</td>
</tr>
<tr>
<td>Norway</td>
<td>EKOM Act § 2-7b</td>
<td>Consent before using cookies or similar storage</td>
</tr>
<tr>
<td>United Kingdom </td>
<td>PECR (Privacy and Electronic Communications Regulations)</td>
<td>Consent before placing cookies or trackers</td>
</tr>
<tr>
<td>Sweden</td>
<td>Electronic Communications Act (2003:389)</td>
<td>User must consent before storing/accessing info</td>
</tr>
<tr>
<td>Finland </td>
<td>Act on Electronic Communications Services</td>
<td>Consent required before any non-essential access</td>
</tr>
</tbody>
</table>
</div>
Note: Every EU Member State is obligated to transpose ePD into national law. The enforcement details vary slightly, but the core requirement of prior consent for tracking remains universal.

Learn why modern tracking scripts often load invisibly, doing so in ways that bypass what most developers see in the console.

Why Privacy Violations Often Go Unseen

You Can't Trust the Developer Console: Why Privacy Violations Often Go Unseen

Blog Aesirx

Most tracking isn’t visible in DevTools. Learn why GTM, HAR files, and privacy scans reveal what your console hides and why consent must come first.

<a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/download/1.8.0/plg_aesirx_consent.zip">AesirX Consent Management Platform (CMP) for WordPress v1.8.0</a> introduces new features to give site owners better visibility, stronger control, and improved legal readiness.
This release adds advanced consent analytics, new admin dashboard tools, and support for eight more languages – offering you deeper behavioral insights, enhanced audit trails, and broader multilingual compliance.
Whether you're managing regional requirements or preparing for audits, these updates give you deeper insights and stronger data control, all without extra coding or third-party dependencies.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Missed our last update?
Read: <a href="https://aesirx.io/blog/aesirx/aesirx-cmp-for-wordpress-v-1-7-0" target="_blank" rel="noopener" class="undefined text-success">AesirX CMP for WordPress v1.7.0: Smarter Regional Compliance with Enhanced Configuration Capabilities</a>
</div>
What’s New in CMP v1.8.0?
<h2>Advanced Consent Analytics</h2>
AesirX CMP Version 1.8.0 introduces a built-in dashboard for analyzing user consent behavior. This update adds a rich analytics layer to your WordPress admin panel. The following insights are now available:
<h3>1. Consent Behavior Metrics</h3>
<ul>
<li aria-level="1">Number of:
<ul>
<li aria-level="2">Opt-ins (initial consents)</li>
<li aria-level="2">Opt-outs (revocations)</li>
<li aria-level="2">Partial consents (custom category selections)</li>
<li aria-level="2">Denials (rejections, ignores)</li>
</ul>
</li>
</ul>
<h3>2. Interaction Flow</h3>
<ul>
<li aria-level="1">How users interact with:
<ul>
<li aria-level="2">Consent modal (accept all, customize, dismiss)</li>
<li aria-level="2">Shield of Privacy icon</li>
<li aria-level="2">Revoke buttons</li>
</ul>
</li>
</ul>
<h3>3. Category-Level Stats</h3>
<ul>
<li aria-level="1">Consent status per category (e.g., Analytics accepted 62%, Advertising rejected 38%).</li>
<li aria-level="1">Trends in consent shifts over time</li>
</ul>
<h3>4. Regional + Language-Based Trends</h3>
<ul>
<li aria-level="1">Consent behavior mapped by:
<ul>
<li aria-level="2">Browser language</li>
<li aria-level="2">Time zone</li>
</ul>
</li>
</ul>
<h3>5. User Override Language</h3>
<ul>
<li aria-level="1">Tracks how often users manually change their region settings.&nbsp;</li>
</ul>
<h2>New Admin Dashboard Features</h2>
⮕ Timeline Charts - Daily / Weekly / Monthly consent patterns. Plus track spikes in opt-outs or revokes.
⮕ Filter Controls - Filter by: Date range, Consent type (opt-in, revoke, partial), and Region / language / category.
⮕ Export Options - CSV and JSON. Compatible with external compliance systems (BI tools, regulators).
⮕ Session-Level Drill-Down (Optional) - View anonymized user journey per session: Consent actions, Time of interaction, and Changes in settings.
<div class="table-responsive">
<table class="table table-bordered">
<tbody>
<tr>
<td colspan="2">
<h3 class="mb-0 text-center">Example Use Cases</h3>
</td>
</tr>
<tr>
<td style="text-align: center;">Use Case</td>
<td style="text-align: center;">Value Delivered</td>
</tr>
<tr>
<td>See which categories are most declined</td>
<td>Adjust marketing/legal approach to improve consent rates</td>
</tr>
<tr>
<td>Track opt-out spikes after a campaign</td>
<td>Evaluate user trust &amp; response to changes</td>
</tr>
<tr>
<td>View language-specific rejection rates</td>
<td>Improve translation, cultural fit of consent messaging</td>
</tr>
<tr>
<td>Compare EU vs. US consent behavior</td>
<td>Guide legal and UX strategy per market</td>
</tr>
<tr>
<td>Audit compliance logs for regulators</td>
<td>Easily generate exportable, timestamped records</td>
</tr>
</tbody>
</table>
</div>
<img src="https/api.aesirx.io/images/cmp_v1-8-1.png" alt="cmp_v1-8-1.png" width="1200" height="630" />AesirX CMP: Consent Analytics – better for analyzing user consent behavior
<h2>8 More Languages, Supporting 33 in Total</h2>
To support growing international adoption, this update includes eight new languages:
<h3>Languages added:</h3>
<ul>
<li aria-level="1">Bulgarian (BG)</li>
<li aria-level="1">Slovak (SK)</li>
<li aria-level="1">Ukrainian (UA)</li>
<li aria-level="1">Croatian (HR)</li>
<li aria-level="1">Hindi (HI)</li>
<li aria-level="1">Traditional Chinese – Hong Kong (ZH-HK)</li>
<li aria-level="1">Serbian (SR)</li>
<li aria-level="1">Tagalog (TL)</li>
</ul>
<h3>Why this matters:</h3>
Under regulations like the GDPR and ePrivacy Directive, valid consent must be informed – meaning users need to clearly understand what they’re agreeing to, in a language they comprehend. Failure to provide consent information in a user's native or browser language can result in non-compliant consent collection.
By expanding support to 33 languages, <a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener">AesirX CMP helps businesses</a> meet these legal standards and deliver a more trustworthy, accessible experience. Localized modals reduce confusion, improve consent accuracy, and increase user trust – especially important for global websites serving multilingual audiences.
<img src="https/api.aesirx.io/images/cmp_v1-8-2.png" alt="cmp_v1-8-2.png" width="1200" height="630" />AesirX CMP: Multi-Language CMP 
<h2>Upcoming Features</h2>
The next versions of AesirX CMP will continue expanding features focused on consent enforcement, automation, and localization. Expect continuous improvements – based on real-world needs and ongoing changes in global privacy laws.
Stay tuned – we’re just getting started.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
What legal and compliance teams need to know:
Read: <a href="https://www.linkedin.com/pulse/california-privacy-enforcement-alert-honda-case-christiansen-neioc/" target="_blank" rel="noopener" class="undefined text-success">California Privacy Enforcement Alert: Honda Case Confirms Strict Privacy Compliance Expectations</a>
</div>
<h2>How to Get AesirX CMP for WordPress</h2>
AesirX CMP is available as an open-source plugin on GitHub with a 14-day free trial of premium features.
➡ Download here: <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/download/1.8.0/plg_aesirx_consent.zip">AesirX CMP for WordPress – GitHub Releases</a>
For complete data privacy solutions, including First-Party Analytics and Consent Management, explore our ecosystem at: <a href="https://www.aesirx.io">https://www.aesirx.io</a>
AesirX CMP v1.8.0 continues to raise the standard for privacy compliance and consent transparency. With features designed to meet real regulatory demands and user trust, it gives website owners full control while respecting the rights of every visitor.
For questions, support, or implementation guidance, visit our documentation or reach out via <a href="https://github.com/aesirxio">GitHub</a>.
<hr />
Sources:
<a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679#d1e1889-1-1">GDPR – Article 7: Conditions for Consent</a>
<a href="https://cppa.ca.gov/regulations/pdf/cppa_regs.pdf">CPRA – California Privacy Protection Agency – CPRA Regulations </a>

AesirX CMP for WordPress v1.8.0: Deeper Insight Into User Behavior

Press Release Aesirx

AesirX CMP for WordPress v1.8.0 adds advanced consent analytics, exportable insights, and 8 new languages – giving WordPress users deeper control and legal readiness.

AesirX CMP for WordPress v1.8.0

The Real Problem Isn't Technical – It's Intentional
Last week, I wrote <a href="https://www.linkedin.com/pulse/defence-eprivacy-directive-53-privacys-last-stand-christiansen-iruie/">in defense of ePrivacy Directive Article 5(3)</a> - the only EU legal provision that protects users before tracking begins. The response was clear: privacy professionals understand its value, but many businesses either don’t - or worse - actively ignore it.
This week, I want to go deeper. Because tracking before consent isn't just an oversight. It's a feature of the current digital advertising model. And the industry's favorite tools – including Google Tag Manager and Consent Mode 2.0 – are being used to simulate compliance, not enforce it.
<h2>What ePrivacy Directive 5(3) Actually Says</h2>
Before we go further, let’s be clear: Article 5(3) is not about cookies. It’s about any access to or storage of information on a user’s device, whether or not personal data is involved. This includes:
<ul>
<li aria-level="1">Loading third-party scripts</li>
<li aria-level="1">Embedding beacons or SDKs</li>
<li aria-level="1">Collecting telemetry or device signals</li>
<li aria-level="1">Executing fingerprinting code</li>
</ul>
Unless it's strictly necessary for the service requested (e.g., login, shopping cart), it requires prior informed consent. GDPR applies after. ePrivacy Directive 5(3) comes first.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/what-eprivacy-directive-53-actually-says.png" alt="what eprivacy directive 53 actually says" width="1536" height="1024" />
<h2>What Happens on Most Websites Today?</h2>
Breaking it down, here’s what actually happens the moment a user lands on a typical website:
<ol>
<li aria-level="1">Google Tag Manager (GTM) loads immediately, often in the header.</li>
<li aria-level="1">GTM injects other scripts: Google Analytics, Facebook Pixel, LinkedIn Insight Tag, Hubspot, Hotjar, etc.</li>
<li aria-level="1">Some sites use Google Consent Mode 2.0 - which claims to defer data collection until consent is given.</li>
<li aria-level="1">But GTM has already loaded. Third-party domains have already been contacted. Scripts have run. Devices have been accessed.</li>
</ol>
Consent hasn't even been asked for yet.
This is not compliant with the ePrivacy Directive Article 5(3).
It’s tracking before consent. Plain and simple.
<h3>Consent Mode ≠ Consent</h3>
Let’s debunk the Consent Mode 2.0 myth.
“Consent Mode lets you run all your tags in a compliant way, while respecting user choice.”
That sounds nice. But here’s what actually happens:
<ul>
<li aria-level="1">GTM loads as a first-party script (from www.googletagmanager.com).</li>
<li aria-level="1">Tags like gtag.js, ads/ga-audiences, or collect?v=... are conditionally fired, but scripts and domains are still initialized.</li>
<li aria-level="1">Even in “denied” mode, telemetry and anonymized signals can be collected – and linked later.</li>
<li aria-level="1">Worse, many websites configure Consent Mode to 'assume consent' until it’s explicitly denied.</li>
</ul>
It’s not a bug. It’s a dark pattern wrapped in a compliance-friendly wrapper.
<h3>Enter: Cookie Consent as a Service (CCaaS) – The Theatre of Compliance</h3>
Now let’s address the other half of the illusion: Cookie Consent banners – often provided by Consent Management Platforms (CMPs) like OneTrust, Cookiebot, CookieInformation, TrustArc, and similar vendors.
These services position themselves as compliance tools. But in most implementations, they are part of the consent theatre. Here's why:
<h4>1. Scripts Already Load Before Consent Is Given</h4>
Most CMPs do not block GTM or other tracking scripts by default. Instead, they load with the site, and merely signal preferences after third-party access has already occurred. This violates ePrivacy Directive 5(3).
<h4>2. Visual Consent ≠ Technical Enforcement</h4>
The banner might ask for your permission to use analytics or marketing cookies. But unless script loading is gated, that data is already being collected, or the tracker has already "touched" your device - even if just to generate a fingerprint or store a default ID.
<h4>3. “Essential” Categories Are Misused</h4>
Most CMPs allow website owners to mark trackers as "essential" - avoiding consent entirely. This loophole is abused heavily. Tag managers, CDNs, and analytics frameworks are regularly misclassified to bypass user consent.
<h4>4. Most CMPs Are Not Transparent</h4>
CMPs rarely disclose what scripts are running at what point in the lifecycle. Users assume that saying “no” blocks tracking. But unless the site implements strict pre-consent gating, it doesn’t. And CMPs don’t verify or audit that logic - because it’s not in their business interest.
<h4>5. Consent Is Required for All Tracking Technologies – Not Just Cookies</h4>
Too many implementations treat cookie consent as synonymous with privacy compliance - but tracking is not limited to cookies. Beacons, fingerprinting scripts, local storage, telemetry APIs, and session replay tools can all access or store data on a device.
Under the ePrivacy Directive Article 5(3), all tracking technologies require prior informed consent unless they are strictly necessary. CMPs and Consent Mode flows that focus only on cookie categories ignore the broader scope of what the law actually covers.
“If your site blocks cookies but still allows fingerprinting scripts or session data access, you're not compliant - you're just cookie-washing surveillance.”
<h4>6. Many Cookie Consent Services Are Trackers Themselves</h4>
Ironically, many Consent Management Platforms (CMPs) and Cookie Consent as a Service (CCaaS) providers operate as third-party services - and embed their own pixel trackers or scripts into websites. This means:
<ul>
<li aria-level="1">Their domains are contacted on first load (before any user action).</li>
<li aria-level="1">They often drop their own cookies or collect telemetry (device type, locale, IP, etc.) to “optimize” or “audit” consent interactions.</li>
<li aria-level="1">This constitutes third-party access to the user’s device without consent - exactly what they claim to protect against.</li>
</ul>
When your CMP vendor requires a call to their external domain and executes JavaScript before consent, they become part of the violation - not part of the solution.
“You can’t outsource consent to a service that tracks users before they give it.”
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/the-real-problem-isnt-technical-its-intentional.png" alt="the real problem isnt technical its intentional" width="1536" height="1024" />
<h3>It’s All Connected: CMPs + Consent Mode = A Pretend Consent Loop</h3>
Here's how the architecture works in reality:
<ul>
<li aria-level="1">GTM is preloaded, acting as the vehicle for third-party access.</li>
<li aria-level="1">A CMP (CCaaS) visually asks the user for consent.</li>
<li aria-level="1">Google Consent Mode receives the user's choice after the fact, and adjusts data labeling - but does not retroactively stop what has already happened.</li>
<li aria-level="1">Meanwhile, first-party and third-party servers have already seen device requests, and in many cases, set up tracking identifiers, cookies, or other session elements.</li>
</ul>
This is not privacy by design. It's tracking by default, consent by UX overlay.
And because it's standardized across large platforms, it's scalable non-compliance. Millions of websites are complicit, and most users are unaware.
<h3>This Is By Design – Not Accident</h3>
Why is it so widespread?
Because this design keeps the data flowing.
<ul>
<li aria-level="1">Advertisers want to capture behavior from the first second.</li>
<li aria-level="1">Personalization engines want to log device signals and interaction history.</li>
<li aria-level="1">CDPs and data brokers want identifiers, even if they start "pseudonymous."</li>
</ul>
In this ecosystem, real prior consent is a threat. It delays tracking, shrinks datasets, and cuts off third-party access.
That’s why most CMPs are built to preserve tracking, not prevent it.
<h3>Enforcement Failure: Why It Persists</h3>
We already have the law. But we don’t have the enforcement.
Most Data Protection Authorities (DPAs) lack the technical infrastructure to perform deep inspections of what scripts do at runtime. They see cookies, not what JavaScript does. They review the consent text, not whether access occurred before it was given.
Until we automate technical audits and enforce real-time violations, the current model will persist.
That’s why regulatory enforcement must evolve. And that’s where Privacy Monitoring solutions come in.
<h3>We Need First-Party Alternatives, Not Third-Party Excuses</h3>
At AesirX, we’ve built an entirely first-party consent, analytics, and tag management system – compliant by design with both GDPR and ePrivacy Directive 5(3):
<ul>
<li aria-level="1">No third-party access until consent is granted.</li>
<li aria-level="1">No pre-consent tracking or device access.</li>
<li aria-level="1">Fully transparent, auditable, and open-source.</li>
<li aria-level="1">Prevents GTM from loading until after Consent is given.</li>
</ul>
We don't need to "balance" user rights with tracking profits. We need to design systems that respect rights by default.
If We Don’t Enforce 5(3), Consent Dies in Practice
We’re not in a post-cookie world. We’re in a pre-consent tracking world. And unless we defend Article 5(3), we will lose the only legal shield that blocks tracking at the door.
GDPR starts after the data flows.
The ePrivacy Directive is the only thing that can stop it before it begins.
Repealing 5(3) won’t simplify compliance. It will legalize surveillance at the infrastructure level.
And that’s not innovation.
That’s surrender.
<h3>It’s Time to Stop Pretending</h3>
To those who call Article 5(3) outdated:
It’s not outdated. It’s inconvenient for those whose business depends on ignoring consent.
To those building digital products:
Build them privacy-first, not privacy-later. Your users deserve consent that’s real, not retroactive.
To regulators:
Don’t just review banners. Inspect the scripts. Audit what happens before consent is ever given. That’s where the real violations start.
And to the industry at large:
Cookie Consent banners won’t save you from non-compliance. If GTM or any third-party tracker loads before consent, you’re already in violation – no matter how pretty your UX is.
If tracking happens before I say yes, I was never given a choice at all.
Ronni K. Gothard Christiansen Technical Compliance Engineer &amp; CEO @ AesirX
<hr />
<h3>Take the First Step Toward Real Compliance</h3>
If you’re using WordPress and want to ensure your site truly respects privacy – before consent is given – we’ve built a first-party Consent Management Platform that does exactly that.
It’s easy to install, doesn’t rely on third-party trackers, and helps you comply with both GDPR and ePrivacy Directive 5(3) from the first page load.
Try it free for 14 days and see the difference real consent makes:&nbsp;<a href="https://aesirx.io/solutions/consent-management-platform">https://aesirx.io/solutions/consent-management-platform</a>

Tracking before consent is a feature of the current digital advertising model. ePrivacy 5(3) is the last protection users have before tracking begins

Tracking Before Consent: It’s the Business Model

Tracking Before Consent: It’s Not Just a Bug. It’s the Business Model

Article 5(3) of the ePrivacy Directive protects users before device access, but it’s being deliberately undermined by the digital advertising industry.

The Only Law That Stops Tracking Before It Starts
There’s a growing push to dismantle Article 5(3) of the ePrivacy Directive - the so-called “cookie law.” Critics argue it’s outdated, redundant because of the GDPR, and a burden to digital business.
That argument misses the mark entirely.
Article 5(3) is the only EU legal provision that restricts the technical act of tracking – before any data is stored, accessed, or classified. It applies to all device access, not just cookies. That includes scripts, pixels, SDKs, and beacons, regardless of whether they store personal data. The GDPR only applies after data becomes “personal.” By then, the damage is done.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
“If we lose ePrivacy 5(3), we lose the only legal control users have before tracking begins. GDPR doesn’t replace it. It follows after.” - Ronni K. Gothard Christiansen
</div>
<h2>What’s really happening in practice?</h2>
Modern tracking often avoids cookies entirely. Server-side tag managers, fingerprinting, and telemetry data collection are embedded on first page load. Consent Mode 2.0, as deployed on most large websites, still loads the full GTM framework by default - analytics, ads, and even third-party beacons.
Consent is delayed, but data is already flowing. Few websites defer loading until after consent, even though it’s possible. This isn’t a technical limitation. It’s a design choice - one made to preserve marketing data at the cost of user rights.
And under GDPR alone, it’s hard to stop. Most of this data isn't “personal” at the moment of capture. Profiling happens later, in backend systems and ad networks. The GDPR kicks in downstream. Article 5(3) is the only regulation that stops access upfront.
<h2>So why the push to kill it?</h2>
Because 5(3) gets in the way. It forces businesses to ask for consent before loading surveillance tech. It reduces default data capture, breaks dark pattern consent flows, and limits third-party tracking. It’s a legal roadblock to surveillance capitalism.
Repealing or weakening 5(3) won’t help consumers. It will simply make it easier for BigTech and ad brokers to extract more behavioral data by default.
Let’s be honest about the trade-offs:
<ul>
<li aria-level="1">Privacy isn't the problem. Non-compliance is.</li>
<li aria-level="1">Poor implementation of consent banners isn’t a reason to remove consent requirements.</li>
<li aria-level="1">Consent Mode that collects data before consent is not compliance. It’s privacy theatre.</li>
</ul>
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/where_eprivacy-5-3-and-gdpr-actually-apply.png" alt="where eprivacy 5 3 and gdpr actually apply" width="1536" height="953" />
<h3>We don’t need fewer rules. We need better enforcement.</h3>
Instead of dismantling 5(3), we should be scanning websites, auditing scripts, and enforcing technical compliance. We should stop loading third-party trackers until after informed consent. And we should move toward first-party solutions that respect user rights by design.
At <a href="https://aesirx.io" target="_blank" rel="noopener">AesirX</a>, we’ve built a full <a href="https://www.aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener">first-party alternative to adtech dependency</a>. Consent, <a href="https://www.aesirx.io/solutions/analytics" target="_blank" rel="noopener">analytics</a>, and tagging - all privacy-first and fully GDPR + ePrivacy-compliant.
<h3>We’re not in a “post-cookie” world. We’re in a pre-consent tracking world.</h3>
If we abandon Article 5(3), there’s nothing left to protect users before they’re tracked.
That’s not privacy. That’s surrender.
Ronni K. Gothard Christiansen, AesirX.io
If you are in doubt if your website or e-commerce solution is loading beacons and other tracking technologies before consent is given you can check it in our <a href="https://aesirx.io/services/privacy-scanner">free privacy scanner</a>.

Why repealing ePrivacy 5(3) would gut the only EU law that blocks tracking before consent. GDPR isn’t enough. Users need real protection – at the start.

In Defence of ePrivacy Directive 5(3): The Last Stand

In Defence of ePrivacy Directive 5(3): Privacy’s Last Stand

ePrivacy 5(3) is the only EU law that blocks tracking before consent. Without it, users are exposed before GDPR applies. Don’t scrap real privacy protection.

AesirX Consent Management Platform (CMP) for WordPress v1.7.0 introduces a powerful set of updates designed for site admins, developers, and agencies who need greater flexibility in managing privacy compliance – whether locally or across multiple regions.
This release focuses on enhanced configuration capabilities – allowing you to define and automate consent behavior based on time zone, browser language, and legal jurisdiction, all from within your CMP dashboard.
With full support for both opt-in and opt-out models and new handling of Global Privacy Control (GPC) signals, your site can now apply consent requirements dynamically with no custom coding or third-party scripts needed.
Whether you’re maintaining GDPR compliance in the EU, supporting CPRA requirements in California, or delivering localized consent experiences for a multilingual audience, AesirX CMP v1.7.0 gives you the tools to do it all, reliably and at scale.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Missed our last update?
Read: <a href="https://aesirx.io/blog/aesirx/aesirx-cmp-for-wordpress-v-1-6-0-configurable-consent-logic-and-more-languages" target="_blank" rel="noopener">AesirX CMP for WordPress v1.6.0: Configurable Consent Logic and More Languages</a>
</div>
<h2>What’s New in v1.7.0?</h2>
<h3>Regional Handling – Language and Time Zone-Based Enforcement Settings</h3>
<a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.7.0" target="_blank" rel="noopener">AesirX CMP Version 1.7.0</a> introduces enhanced regional configuration capabilities, allowing your consent setup to automatically adjust based on the user’s location and legal environment. This includes:
Time zone detection to apply region-specific consent behavior
AesirX Consent Management Platform can now detect the user's time zone and apply the appropriate consent logic automatically – whether opt-in (e.g. GDPR regions) or opt-out (e.g. California).
→&nbsp;Benefit: You don’t need to hard-code regional rules. The system dynamically aligns with local laws, reducing configuration time and lowering your compliance risk.
<h4>Language configuration to present modals and choices in the user’s native language</h4>
Modals, buttons, and privacy choices are displayed in the user’s browser language or country-specific setting.
→&nbsp;Benefit:&nbsp;This ensures users understand what they’re consenting to – meeting legal requirements for informed consent and improving trust by providing a more transparent, localized experience.
&nbsp;<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-language-configuration-and-time-zone-aware-consent.png" alt="aesirx cmp language configuration and time zone aware consent" width="1876" height="1328" />
AesirX CMP: Language configuration and Time Zone-Aware Consent
<h3>8 More Languages Now Supported (Total 25)</h3>
To support an even broader audience, this release adds eight new languages:
Languages added:
<ul>
<li aria-level="1">Finnish (FI)</li>
<li aria-level="1">Romanian (RO)</li>
<li aria-level="1">Hungarian (HU)</li>
<li aria-level="1">Indonesian (ID)</li>
<li aria-level="1">Hebrew (HE)</li>
<li aria-level="1">Czech (CS)</li>
<li aria-level="1">Greek (EL)</li>
<li aria-level="1">Malay (MS)</li>
</ul>
<h4>Why this matters:</h4>
Under privacy laws like the GDPR and the ePrivacy Directive, valid consent requires that users clearly understand what they are agreeing to. That includes presenting consent information in a language the user understands. By supporting 25 languages (with more to come), <a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener">AesirX CMP</a> helps businesses meet this requirement – delivering localized consent dialogs that improve comprehension, reduce legal risk, and support valid user consent across jurisdictions.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-multi-language-cmp.png" alt="aesirx cmp multi language cmp" width="1876" height="1328" />
<h2>Upcoming Features</h2>
After v1.7.0’s release, our roadmap continues with key enhancements:
<ul>
<li aria-level="1">Advanced Consent Analytics:&nbsp;Gain deeper insight into consent behavior with extended compliance logging and reporting capabilities.</li>
</ul>
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
What legal and compliance teams need to know:
Read: <a href="https://www.linkedin.com/pulse/california-privacy-enforcement-alert-honda-case-christiansen-neioc/" target="_blank" rel="noopener">California Privacy Enforcement Alert: Honda Case Confirms Strict Privacy Compliance Expectations.</a>
</div>
<h2>How to Get AesirX CMP for WordPress</h2>
AesirX CMP is available as an open-source plugin on GitHub with a 14-day free trial of premium features.
➡ Download here: <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.7.0" target="_blank" rel="noopener">AesirX CMP for WordPress – GitHub Releases</a>
For complete data privacy solutions including First-Party Analytics and Consent Management, explore our ecosystem at: <a href="https://www.aesirx.io">https://www.aesirx.io</a>
AesirX CMP v1.7.0 continues to raise the standard for privacy compliance and consent transparency. With features designed to meet real regulatory demands and user trust, it gives website owners full control while respecting the rights of every visitor.
For questions, support, or implementation guidance, visit our documentation or reach out via GitHub.
<hr />
Sources:
<a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679">Eur-LEX: General Data Protection Regulation</a>

AesirX CMP for WordPress v1.7.0: Smarter Regional Compliance with Enhanced Configuration Capabilities

AesirX CMP for WordPress v1.7.0 adds time zone-aware consent logic, time zone detection, and 25 languages for smarter, more flexible privacy compliance.

AesirX CMP for WordPress v1.7.0

Each week, more businesses implement “cookie banners” thinking they’ve done what’s required for privacy compliance. But there’s a growing misunderstanding in the industry - one that creates real legal risk:
Consent banners alone do not make your website compliant.
Why? Because it's not just about cookies. It’s about all tracking technologies.
That includes:
<ul>
<li aria-level="1">Beacons</li>
<li aria-level="1">Pixels</li>
<li aria-level="1">JavaScript-based tracking</li>
<li aria-level="1">SDKs</li>
<li aria-level="1">Server-side tracking</li>
<li aria-level="1">Tag management systems (TMS)</li>
</ul>
Every one of these methods can collect personal data, and many are activated before a user has given valid consent.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/consent-banners-alone-do-not-make-your-website-compliant.png" alt="consent banners alone do not make your website compliant" width="2400" height="1260" />
<h2>The Legal Foundation: ePrivacy Directive and National Laws</h2>
Article 5(3) of the ePrivacy Directive (as implemented in national laws like the UK's PECR, Norway’s Ekomloven, Vietnam's PDPL and other countries with clear consent requirements) requires that storing or accessing information on a user’s device may only take place with the user’s prior consent, unless it's strictly necessary for the service the user has requested.
Consent under both the ePrivacy Directive and GDPR must be:
<ul>
<li aria-level="1">Freely given</li>
<li aria-level="1">Specific</li>
<li aria-level="1">Informed</li>
<li aria-level="1">Unambiguous</li>
</ul>
This means any tracking technology - whether it places a cookie or not - cannot be activated before consent has been obtained.
And yet, server-side tagging and tag management systems like Google Tag Manager are regularly implemented in a way that pre-loads third-party trackers or sends data to external vendors before the user has had the opportunity to understand or agree to that processing.
If the user isn’t aware, and hasn’t agreed to the full scope of tracking, consent is invalid.
<h2>Server-Side Tagging and Google Tag Manager: Compliance Concerns</h2>
Server-side tracking and tag management systems are often presented as privacy-preserving alternatives. But the reality is more nuanced:
These solutions still process and route personal data - often to third parties such as Google, Facebook, or other advertising networks.
In many cases, data is collected and transmitted regardless of user consent, simply because scripts are embedded server-side or controlled from a centralized tag manager. Without proper control and enforcement mechanisms, these tools can become invisible vectors of non-compliant tracking.
One key example is Google Tag Manager (GTM). When GTM is loaded, it immediately results in the transfer of the user's IP address and potentially exposes the entire DOM and Data Layer to Google. This constitutes personal data processing under both the ePrivacy Directive (ePD) and GDPR as well as other legal foundations.
“As such, GTM cannot be legally loaded before consent is obtained - because it enables the access and transfer of data not strictly necessary for delivering the service the user requested.”
It’s also worth emphasizing:
“Moving GTM (or any tracking logic) to a first-party environment does not eliminate the requirement for consent.”
Under Article 5(3) of the ePrivacy Directive (PECR, Ekomloven, PDPL, etc.), any collection or access to information from a user’s device - first-party or third-party - that is not strictly technically necessary, requires prior consent. This includes analytics, personalization, marketing, and performance tracking.
Using these tools does not bypass the need for explicit, informed, prior consent. If tracking or data transmission happens before that, it is a clear breach of the ePrivacy Directive.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Read more:
<a href="https://www.linkedin.com/pulse/your-cookie-banner-lying-you-ronni-k-gothard-christiansen-etcie/" target="_blank" rel="noopener">Your Cookie Banner is Lying to You</a>
</div>
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/bonnier-news-ab-fined-13-million-sek-by-the-swedish-authorities.png" alt="bonnier news ab fined 13 million sek by the swedish authorities" width="2400" height="1260" />
<h2>Real-World Enforcement: Bonnier AB Case</h2>
This is not theoretical - regulators are now enforcing this aggressively.
In November 2023, Bonnier News AB was fined 13 million SEK by the Swedish Authority for Privacy Protection (IMY) and <a href="https://www.linkedin.com/pulse/full-analysis-imy-case-against-bonnier-news-ab-moment-christiansen-8xiqc/">ruled by Forvaltningsretten</a> in Stockholm February 2025. Why?
<ul>
<li aria-level="1">They collected consent for the use of cookies for certain purposes.</li>
<li aria-level="1">But once data was collected, it was shared with multiple third parties.</li>
<li aria-level="1">That data was used for additional purposes beyond those explicitly consented to.</li>
</ul>
The IMY made it clear: consent must match the actual processing. If consent is obtained for one purpose and data is later shared or reused for others, it is a violation of GDPR and ePrivacy.
This case highlights the growing risk of mismatched consent - something that’s especially common when using tag managers, complex marketing stacks, or third-party tracking solutions.
<h2>Enforcement is Scaling: Automated Monitoring is Here</h2>
The regulatory landscape is rapidly shifting:
<ul>
<li aria-level="1">The UK ICO has started <a href="https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/01/ico-takes-action-to-tackle-cookie-compliance-across-the-uk-s-top-1-000-websites/">systematically monitoring the top 1,000 websites</a> in the country.</li>
<li aria-level="1">The Dutch DPA is doing the same for the <a href="https://www.linkedin.com/posts/ronnikc_ap-waarschuwt-50-organisaties-om-misleidende-activity-7317867442410532864-jy75?utm_source=share&amp;utm_medium=member_desktop&amp;rcm=ACoAAAGAuZQBE5WKyUehmu2_z0IQ9ReAwrh9NRY">top 10,000 websites in the Netherlands</a>.</li>
<li aria-level="1">Other DPAs are expected to follow suit, adopting automated, ongoing scanning of public websites.</li>
</ul>
This is significant. Unlike the GDPR, where compliance is often assessed via internal documentation and process audits, ePrivacy Directive compliance is technical - and binary:
You are either compliant, or you are not.
<ul>
<li aria-level="1">Tracking occurs before consent? You're in breach.</li>
<li aria-level="1">Data is shared without the proper legal basis? You're in breach.</li>
<li aria-level="1">Your consent banner doesn’t reflect actual tracking behavior? You're in breach.</li>
</ul>
There is no in-between.
<h2>Continuous Monitoring Is Now Essential</h2>
At AesirX, we anticipated this shift and built our <a href="https://aesirx.io/services/privacy-monitoring/why-privacy-monitoring">Privacy Monitoring Service</a> accordingly.
We provide:
<ul>
<li aria-level="1">Continuous scanning of your website to identify unauthorized trackers</li>
<li aria-level="1">Detection of server-side and tag-managed tracking that bypasses consent</li>
<li aria-level="1">Real-time alerts when new technologies are embedded that may put you at risk</li>
</ul>
Your website is constantly changing - marketing teams deploy new tools, developers push updates, vendors introduce tracking scripts via integrations. Without continuous oversight, your site can become non-compliant overnight.
Privacy is not a one-time project. It’s an ongoing responsibility.
<h2>Key Takeaways for Compliance</h2>
<ul>
<li aria-level="1">If your compliance strategy starts and ends with a cookie banner, it’s insufficient.</li>
<li aria-level="1">If your server-side tagging or tag manager loads third-party scripts before consent, it’s unlawful.</li>
<li aria-level="1">If your actual data processing exceeds the scope of what users consented to, it's a violation.</li>
</ul>
Today’s regulatory landscape demands transparency, technical accuracy, and continuous monitoring.
That’s not just best practice - it’s now a requirement.
If you want to discuss how AesirX can help keep your site compliant as technology changes, <a href="https://aesirx.io/contact" target="_blank" rel="noopener">feel free to connect</a>.
Ronni K. Gothard Christiansen Technical Compliance Engineer &amp; CEO, AesirX.io

Consent banners alone don’t make your site compliant. It’s not just cookies – unmanaged tracking tech puts your business at legal risk.

No, It's Not Just Cookies – It's All Tracking Technologies

It’s not just cookies – tracking tech like pixels, beacons, and GTM also need consent under GDPR and ePrivacy Directive. Regulators are now enforcing this.

We’re excited to announce the release of <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.6.0">AesirX Consent Management Platform (CMP) for WordPress v1.6.0</a> – delivering even more flexibility and usability to support global compliance.
This update introduces configurable consent logic for opt-in/opt-out control, giving site administrators the ability to align tracking behavior with jurisdictional requirements – whether operating under GDPR in Europe or CCPA in California. It also adds eight new languages, helping more users understand and manage consent in their native language.
As regulations continue to evolve across GDPR, ePrivacy Directive, CCPA/CPRA, and more, AesirX CMP stays ahead – giving you the tools to comply without compromising user trust or data transparency.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Missed our last update?
Read:<a href="https://aesirx.io/blog/aesirx/aesirx-cmp-for-wordpress-v1-5-0-consent-logging-and-more-customizable-user-control" target="_blank" rel="noopener"> AesirX CMP for WordPress v1.5.0: Consent Logging and More Customizable User Control</a>
</div>
<h2>What’s New in v1.6.0?</h2>
<h3>Configurable Consent Logic: Opt-In / Opt-Out Control</h3>
This version introduces Configurable Consent Logic, giving site owners and legal teams control over how consent is handled based on jurisdictional requirements. Whether you operate in Europe, California, or globally, your site can now be configured to comply with local laws and user expectations.
How it works:
⮕&nbsp;Choose between opt-in and opt-out models directly within the CMP dashboard.
⮕&nbsp;Opt-in is required under GDPR and the ePrivacy Directive (EU), meaning no tracking until consent is explicitly given.
⮕&nbsp;Opt-out is permitted under laws like California’s CCPA/CPRA, where tracking may occur until users actively opt out.
⮕&nbsp;Easily switch logic based on your legal, regional, or operational needs.
Why this matters:
Consent obligations vary across legal frameworks. In the EU, the GDPR and ePrivacy Directive require an opt-in model, where no tracking occurs until a user explicitly consents.
In the U.S., California’s CPRA (California Privacy Protection Agency) follows an opt-out model, allowing data collection by default – but requiring businesses to provide a clear opt-out mechanism.
Under CPRA, businesses must honor:
– Manual opt-out actions (e.g. clicking a “Do Not Sell or Share My Personal Information” link or opt-ing out directly), and
– Automated opt-out preference signals like Global Privacy Control (GPC) – which must be processed without adding friction or requiring extra steps from the user.
This makes consent logic configuration a compliance-critical feature. With AesirX CMP, you can:
<ol>
<li aria-level="1">Choose between opt-in or opt-out modes based on jurisdiction.</li>
<li aria-level="1">Support CPRA requirements by aligning site behavior with opt-out obligations.</li>
<li aria-level="1">Get ready for advanced features that will enable automatic regional logic and GPC-based behavior in future releases.</li>
</ol>
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/AesirX_CMP_for_WordPress_v1-6-0_-_Graphic_1.png" alt="AesirX CMP: Configurable Consent Logic: Opt-In / Opt-Out Control" width="938" height="664" />
AesirX CMP: Configurable Consent Logic: Opt-In / Opt-Out Control
<h3>8 More Languages Added</h3>
AesirX CMP v1.6.0 continues our commitment to accessibility and global usability by adding support for eight more languages – making it easier for users across the world to make informed consent decisions in their native tongue.
Languages added:
⮕&nbsp;Portuguese (PT)
⮕&nbsp;Italian (IT)
⮕&nbsp;Japanese (JA)
⮕&nbsp;Polish (PL)
⮕&nbsp;Turkish (TR)
⮕&nbsp;Arabic (AR)
⮕&nbsp;Thai (TH)
⮕&nbsp;Korean (KO)
Why this matters:
Localized interfaces improve user trust and legal clarity. With each new language, your website’s compliance setup becomes more inclusive and effective. We're on track to support over 25 languages in total by the end of the month.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/AesirX_CMP_for_WordPress_v1-6-0_-_Graphic_2.png" alt="AesirX CMP for WordPress v1 6 0 Graphic 2" width="1876" height="1328" />
AesirX CMP: Languages available
<h2>Upcoming Features</h2>
After v1.6.0’s release, our roadmap continues with key enhancements:
<ul>
<li aria-level="1">Regional Handling - Multi-Language and Time Zone-Aware Consent Logic</li>
</ul>
We're extending our configurable consent logic to support region-aware consent behavior.
Coming soon:
<ul>
<li aria-level="1">Time zone-based settings to adjust opt-in/opt-out logic based on user location.</li>
<li aria-level="1">Regional integration of Global Privacy Control (GPC).</li>
<li aria-level="1">Multi-language handling per country and region to reflect local preferences.</li>
</ul>
This update will further localize the CMP experience, offering precision control over consent rules by geography.
<ul>
<li aria-level="1">Advanced Consent Analytics</li>
</ul>
Gain deeper insight into consent behavior with extended compliance logging and reporting capabilities.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
What legal and compliance teams need to know: 
Read:&nbsp;<a href="https://www.linkedin.com/pulse/california-privacy-enforcement-alert-honda-case-christiansen-neioc/" target="_blank" rel="noopener">California Privacy Enforcement Alert: Honda Case Confirms Strict Privacy Compliance Expectations.</a>
</div>
<h2>How to Get AesirX CMP for WordPress</h2>
AesirX CMP is available as an open-source plugin on GitHub with a 14-day free trial of premium features.
Download here: <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.6.0">AesirX CMP for WordPress – GitHub Releases</a>
For complete data privacy solutions including First-Party Analytics and Consent Management, explore our ecosystem at: <a href="https://www.aesirx.io"></a><a href="https://www.aesirx.io">https://www.aesirx.io</a>
AesirX CMP v1.6.0 continues to raise the standard for privacy compliance and consent transparency. With features designed to meet real regulatory demands and user trust, it gives website owners full control while respecting the rights of every visitor.
For questions, support, or implementation guidance, visit our documentation or reach out via <a href="https://github.com/aesirxio">GitHub</a>.
<hr />
Sources:
<a href="https://www.uniconsent.com/blog/ccpa-opt-out-preference-signal">CCPA: What is Opt-Out Preference Signal (OOPS)</a>
<a href="https://www.reuters.com/legal/legalindustry/privacy-tug-of-war-states-grappling-with-divergent-consent-standards-2025-03-27">The privacy tug-of-war: States grappling with divergent consent standards</a>
<a href="https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB3048">AB-3048 California Consumer Privacy Act of 2018: opt-out preference signal</a>

AesirX CMP for WordPress v1.6.0 enables opt-in/opt-out consent logic to meet GDPR, ePrivacy, CCPA, and local laws.

AesirX CMP 1.6.0: Custom Consent for GDPR & CCPA

The new AesirX CMP 1.6.0 release supports more languages and flexible consent logic tailored to global legal frameworks.

AesirX CMP 1.6.0: More Languages & Legal Models

AesirX CMP for WordPress v1.6.0: Configurable Consent Logic and More Languages

AesirX CMP for WordPress v1.6.0 with configurable opt-in/opt-out consent logic – giving full control to align with GDPR, ePD, CCPA, and regional legal models.

AesirX CMP for WordPress v1.6.0

It tells users they’re in control. It tells you you're compliant. But the truth? Most websites relying on third-party cookie banners aren’t even close.
They’re still tracking users before consent. They’re still exposed to legal risk. And they’re still treating privacy like a UX problem instead of a technical one.
Because here’s the reality: cookies are only part of the story.
Modern websites track using pixels, fingerprinting, local/session storage, embedded third-party tech, and server-side analytics. Most consent tools don’t even try to stop those. They’re built to look compliant, not be compliant.
<h2>The Dutch Data Protection Authority just made this clear.</h2>
This week, they warned 50 organizations - web shops, media companies, and insurers - to fix their cookie banners or face formal investigations and fines. These are the first 50 from a pool of 10,000 sites being actively monitored by the AP (<a href="https://autoriteitpersoonsgegevens.nl/actueel/ap-waarschuwt-50-organisaties-om-misleidende-cookiebanner">read here</a>).
They’re not guessing anymore. They’re scanning, checking, and demanding technical compliance.
And that’s exactly what we do at AesirX.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
“Technical compliance is binary; either it’s done right or it’s not.” – Ronni K. Gothard Christiansen, Creator of AesirX.io
</div>
<h2>This isn’t hypothetical. It’s happening every day.</h2>
Just last week, I helped a client untangle this exact mess.
They were using a popular third-party cookie banner - it looked clean, ticked all the boxes. But behind the scenes?
⮕&nbsp;14 third-party cookies firing before consent
⮕&nbsp;More than half were wrongly categorized
⮕&nbsp;And here’s the kicker: 23 beacons - pixel trackers, JavaScripts, SDKs - were loading silently, without any opt-in or even opt-out options
No transparency. No user choice. Just hidden tracking - exactly what regulators are looking for.
They thought they were compliant. But the reality? Their setup was a privacy risk waiting to be flagged - and fined.
Most websites aren’t malicious. They’re just relying on tools that don’t actually do the job.
<h2>Using the right tool for the job.</h2>
With AesirX CMP Pro, we’ve built a real privacy layer, not a pretty overlay. No shortcuts. No grey zones. Just tools that actually do what regulators require.
⮕&nbsp;Detects and blocks all tracking technologies (not just cookies)
⮕ Automatically respects GPC (Global Privacy Control) browser signals
⮕ Lets you define opt-in or opt-out logic per region
⮕&nbsp;Offers full consent logging and audit-ready tracking
⮕&nbsp;Already localized for key markets, with 33 languages rolling out in weekly sprints
⮕&nbsp;Transparent, customizable UI for real user control
<a href="https://aesirx.io/blog/press-release/aesirx-cmp-for-wordpress-v1-5-0-consent-logging-and-more-customizable-user-control">AesirX CMP 1.5.0</a> just launched with enhanced consent logging, better modal control, and 8 more languages. AesirX CMP 1.6.0 (coming this week) adds configurable logic for opt-in and opt-out setups. We're not just shipping features - we're building the infrastructure for global, technical compliance.
You can try <a href="https://aesirx.io/solutions/consent-management-platform">AesirX CMP Pro</a> completely free. Just download it from our <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/download/1.5.0/plg_aesirx_consent.zip">GitHub repository</a> and install it in WordPress. It takes minutes to configure - and it works from the first load. No credit card. No lock-in. Just 2 weeks of full access to see what real compliance looks like.
And if you're unsure where your site stands, run a scan with our <a href="https://aesirx.io/services/privacy-scanner">free Privacy Scanner</a>. It checks exactly what regulators are checking - and not just cookies.
Privacy is no longer optional. And now, doing nothing about it isn’t an option either..
Ronni K. Gothard Christiansen Technical Compliance Expert &amp; CEO, AesirX.io
&nbsp;
&nbsp;

Your cookie banner is lying to you

Most cookie banners look compliant but aren’t. AesirX CMP Pro blocks all tracking before consent – for real privacy compliance, not just appearances.

We’re excited to release <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.5.0" target="_blank" rel="noopener">AesirX Consent Management Platform (CMP) for WordPress v1.5.0</a>, continuing our mission to provide a transparent, privacy-first consent experience.
This version introduces a detailed consent logging view for transparency and audits, full text control across consent modal options for brand and legal alignment, a streamlined menu interface that simplifies setup and management, and eight new languages to support global user engagement.
As regulatory expectations grow across GDPR, ePrivacy Directive, CCPA/CPRA and beyond, AesirX CMP strengthens its position as a first-party, privacy-first consent management solution, and continues to evolve with features that support real compliance and informed user choices.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
Missed our last update? 
<a href="https://aesirx.io/blog/aesirx/aesirx-cmp-for-wordpress-v-1-4-0-gpc-compliance-now-supported" target="_blank" rel="noopener">Read: AesirX CMP for WordPress v1.4.0: GPC Compliance Now Supported</a>
</div>
<h2>What’s New in v1.5.0?</h2>
<h3>Improved Consent Logging View&nbsp;</h3>
A new backend consent logging view is available for transparency and audit readiness, now showing detailed logs of user consent actions like consent, revocation, and rejection. This not only helps site owners meet compliance requirements, but also reveals where users are choosing not to consent – offering valuable insights for improving how marketing data is collected.
How it works:
⮕&nbsp;Track timestamped records of when users gave consent, revocation, and rejection.
⮕ Explore visual consent trends over time with built-in charts and graphs for daily, weekly, or monthly breakdowns.
⮕&nbsp;Data is stored securely in the CMP database, and reports can be generated directly from the interface to support compliance efforts.
Why this matters:
Most CMPs lack meaningful visibility into how users interact with consent options. <a href="https://aesirx.io/solutions/consent-management-platform" target="_blank" rel="noopener">AesirX Consent Management Platform</a> offers clear, structured insights into consent behavior – supporting both regulatory compliance, including audit readiness, and data strategy improvements.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-improved-consent-logging.png" alt="aesirx cmp improved consent logging" width="1200" height="628" />
AesirX CMP: Improved Consent Logging
<h3>Customizable Consent Modal: Full Text Control and Granular Consent&nbsp;</h3>
The Consent Modal Management view has been enhanced to give administrators full control over the consent experience. AesirX CMP now allows all modal text – across consent, detail, and reject views – to be customized directly within the platform, making it easy to align with your brand voice, legal requirements, and data strategy.
How it works:
⮕ Edit predefined text for Consent, Detail, and Reject views, including headings, descriptions, and benefits.
⮕ Customize messaging for options like “Reject”, “Consent”, and “Decentralized Consent”, including explanations of what each means.
⮕ Preview and reset individual sections, making it easy to test and adjust your modal content as needed.
Why this matters:
Most consent banners are rigid and generic. AesirX CMP lets you communicate transparently with users – explaining their choices, encouraging informed and fully compliant consent, and supporting advanced models like Decentralized Consent with privacy and rewards. Full text customization ensures that your consent modal reflects your specific data practices and values – improving clarity, trust, and user engagement.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-customize-reject-and-detail-text.png" alt="aesirx cmp customize reject and detail text" width="1200" height="628" />
AesirX CMP: Customize Reject and Detail Text
<h3>Simplified Configuration with New Menu and Views</h3>
To make setup easier, v1.5.0 introduces a reorganized admin structure with better navigation and access to key CMP features.
Updates include:
⮕ Streamlined top-level and sub-menu items for quicker configuration.
⮕&nbsp;Dedicated views for managing Consent Shield settings, reviewing detailed Consent Logs, and customizing text within the Consent Modal.
Why this matters:
Managing consent shouldn’t be complicated. These updates simplify backend workflows and reduce time spent on configuration and updates.
<img src="https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/https/api.aesirx.io/images/aesirx-cmp-new-menu-configuration.png" alt="aesirx cmp new menu configuration" width="1200" height="628" />
AesirX CMP: New Menu Configuration
&nbsp;
<h3>8 New Languages Now Supported</h3>
<a href="https://github.com/aesirxio/wordpress-consent-plugin/releases/tag/1.5.0" target="_blank" rel="noopener">AesirX CMP v1.5.0 </a>expands its language support to include eight additional translations, helping more users understand and manage consent preferences in their native language.
Languages added:
⮕&nbsp;German (DE)
⮕ Danish (DK)
⮕&nbsp;Spanish (ES)
⮕&nbsp;French (FR)
⮕ Dutch (NL)
⮕&nbsp;Norwegian (NO)
⮕&nbsp;Swedish (SE)
⮕&nbsp;Vietnamese (VI)
Why this matters:
Global compliance requires localized experiences. Multi-language support means that your CMP communicates clearly and legally across jurisdictions. More languages will be added in upcoming releases to reach 25+ by the end of the month.
<h2>Upcoming Features</h2>
After v1.5.0’s release, our roadmap continues with key enhancements:
<ul>
<li aria-level="1">Configurable Consent Logic</li>
</ul>
Set opt-in/opt-out behavior based on your site's specific legal or operational requirements.
<ul>
<li aria-level="1">Regional Handling</li>
</ul>
Enable location-aware consent models with multi-language and time zone support, including region-based GPC compliance.
<ul>
<li aria-level="1">Advanced Consent Analytics</li>
</ul>
Gain deeper insight into consent behavior with extended compliance logging and reporting capabilities.
<div class="px-md-40px py-20px border rounded-4 shadow mb-5">
What legal and compliance teams need to know:
<a href="https://www.linkedin.com/pulse/california-privacy-enforcement-alert-honda-case-christiansen-neioc/" target="_blank" rel="noopener">Read California Privacy Enforcement Alert: Honda Case Confirms Strict Privacy Compliance Expectations.</a>
</div>
<h2>How to Get AesirX CMP for WordPress</h2>
AesirX CMP is available as an open-source plugin on GitHub with a 14-day free trial of premium features.
⮕&nbsp;Download here: <a href="https://github.com/aesirxio/wordpress-consent-plugin/releases">&nbsp;AesirX CMP for WordPress – GitHub Releases</a>
For complete data privacy solutions including First-Party Analytics and Consent Management, explore our ecosystem at: <a href="https://www.aesirx.io">https://www.aesirx.io</a>
AesirX CMP v1.5.0 continues to raise the standard for privacy compliance and consent transparency. With features designed to meet real regulatory demands and user trust, it gives website owners full control while respecting the rights of every visitor.
For questions, support, or implementation guidance, visit our documentation or reach out via GitHub.

AesirX CMP v1.5.0 brings consent logging, UI customization, and multilingual support for better WordPress compliance.

AesirX CMP v1.5.0: Consent Logging for WordPress

Upgrade to AesirX CMP v1.5.0 for enhanced consent logs, customizable text, simplified settings, and 8 new languages.

New in AesirX CMP: More Control & Compliance Tools

AesirX CMP for WordPress v1.5.0: Consent Logging and More Customizable User Control

AesirX CMP for WordPress v1.5.0 adds consent logging, full text customization, simplified settings, and eight new languages for better compliance control.

Press and Blogs

POPULAR TOPICS

You Can't Trust the Developer Console: Why Privacy Violations Often Go Unseen

AesirX CMP for WordPress v1.8.0: Deeper Insight Into User Behavior

Tracking Before Consent: It’s Not Just a Bug. It’s the Business Model

In Defence of ePrivacy Directive 5(3): Privacy’s Last Stand

AesirX CMP for WordPress v1.7.0: Smarter Regional Compliance with Enhanced Configuration Capabilities

No, It's Not Just Cookies – It's All Tracking Technologies

AesirX CMP for WordPress v1.6.0: Configurable Consent Logic and More Languages

Your cookie banner is lying to you

AesirX CMP for WordPress v1.5.0: Consent Logging and More Customizable User Control

Join the AesirX Partner Program

Solutions

Resources

Support

Partnership Opportunities