Why it matters
Cookies that land in a visitor's browser before they've clicked anything were set without consent. Any cookie that isn't strictly needed to run the site needs permission first in the EU and UK.
How to check it yourself
In a private window, load your site, click nothing, then open DevTools, Application, Cookies. Names like _ga, _fbp or _hj that are already there were set without consent.
What the fix involves
Find which script sets each non-essential cookie and make it wait for consent. Login, security and the consent choice itself don't need permission.
Reference: gdpr.eu
How vibeliq checks it
We open your site in a real browser, click nothing, and watch what happens: which outside companies it contacts, which cookies land, what your JavaScript files contain, across up to nine of your pages. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.