There are two main reasons why vendors drops cookies before user consent.
1- Legitimate interest Use
IAB vendors automatically receive the Consent String and drop their cookies according to the user's consent status. These vendors are linked to purposes they established for themselves, yet you (publishers) can put some restrictions if you feel the need to.
Some of these IAB vendors are using 'legitimate interest' as a legal basis, it can explain why some cookies can be dropped before consent has been given.
To check if a vendor is part of IAB:
- Go to your consent notice.
- Then to the "VENDORS & PURPOSES" step.
- An IAB vendor has the "IAB" logo next to its API ID.
- You can go and see all the IAB vendors in this list.
- To see all the purposes for every vendor, you can click on "preview" at the top right of your screen. Then go to the third view of your notice "View partners". Click on the name of one of the partners and you will see all the purposes he is linked to.
- Consent based purposes. (1)
- Purposes with legitimate interest. (2)
- Additional data processing purposes. (3)
You will find more information about purposes and features in our article Summary of new features of the TCF v2.
2- Non-IAB vendors Misconfiguration
Non-IAB vendors don't receive consent automatically. It is necessary that you condition the non IAB vendors to the user consent. If you don't, they will drop cookies before user consent. This will represent some configuration on your side, depending on what Tag Manager you are using:
- With your 📰 Tag Manager using one of our integration (We have GTM, Tealium, Eulerian, CommandersAct and Adobe DMT.)
- By modifying the script of your vendor with this 📰 Custom Script method.
- By using our 📰 API