Why it matters
Analytics and ad scripts that load the moment a page opens are tracking people who haven't agreed to it. In the EU and UK those scripts have to wait for a yes, whatever your cookie banner says, and regulators do fine small sites for it.
How to check it yourself
Open your site in a private window with DevTools' Network tab open and click nothing. If requests to google-analytics, googletagmanager, facebook or hotjar appear, they're firing before consent.
What the fix involves
Load tracking scripts only after the visitor clicks Accept, and check that tags inside Google Tag Manager respect consent mode too.
Reference: gdpr.eu
How vibeliq checks it
We open your site in a real browser, click nothing, and watch what happens: which outside companies it contacts, which cookies land, what your JavaScript files contain, across up to nine of your pages. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.