Why does a consent banner reappear on a subdomain?

Usually because the consent cookie was set as host only, so other subdomains cannot read it, or because the CMP is configured differently on that host. Each subdomain looks correct alone, which is why a cross domain test with one browser session is needed to find it.

What cookie scope lets subdomains share consent state?

The consent cookie generally needs its domain attribute set to the registrable domain, with appropriate path and security flags, so sibling subdomains can read it. Exact configuration depends on your CMP and security policy, and should be tested in production.

Should every subdomain show the same banner?

The experience should be consistent, but the key requirement is shared state, not identical pixels. A visitor's recorded choice and preferences must be readable and honoured on every host they reach in a session.

How often should cross subdomain consent be audited?

After any CMP, checkout, or domain change, and on a recurring automated check. Deployments on a single host are the common trigger for a break that only appears when a visitor crosses between subdomains.

Auditing Consent for Embedded Video and Maps That Load Early

October 31, 2026

Video players and map embeds phone home on page load, before any consent choice. Auditing those embeds, and the options: two click loading, self hosted posters, and honest trade offs.

Open a product page in a fresh browser profile and refuse all consent. Then look at the network calls. On many sites the video player has already contacted its platform, the map has loaded and set its cookies, and a review widget has identified the device, all before the visitor chose anything. The banner said one thing. The page did another.

Embeds are the usual leak because they are added by pasting a snippet, and the snippet loads immediately by design. The provider gets page views, referrer data, and often sets identifiers, because that is valuable to the provider. Whether it is lawful or fair to the visitor without consent is the stores problem, not the providers.

Find the embeds that load on arrival

Audit page templates one by one, because embeds hide in different places: video on product pages, maps on contact and store pages, social feeds on the homepage, chat and reviews almost everywhere. For each, record what loads on first view, what cookies are set, and what data leaves before consent. A consent scanner should catch some of this, but embeds that only trigger on certain templates or after scrolling are routinely missed.

Check the mobile version separately. Some embeds are swapped for lighter versions on small screens with different loading behaviour, and some consent setups only gate the desktop variants. The leak does not care which layout it came through.

Two click loading and poster frames

The standard fix is to load a placeholder instead of the embed: a poster image and a play button for video, a static map image and a button for directions. The real embed, with its trackers, loads only when the visitor activates it, which is a choice you can tie to consent for that purpose. Visitors lose nothing they wanted. A person who wants the video clicks once more.

Self hosted or privacy enhanced player modes reduce the leak for the most common video platforms, though they rarely eliminate data transfer entirely once playback starts. Be precise in your own records about what still loads and when. Claiming an embed is tracker free when it phones home on play, even with consent handled correctly, invites the kind of scrutiny that finds the gap.

The trade offs worth naming

Gating embeds can change metrics teams watch. Video play rates fall when a click is added, though the plays that remain are from people who actually wanted them. Map interactions fall in the same way. Name those effects before launch, agree them with the teams involved, and measure them, so the first weekly report does not trigger a quiet rollback that reopens the leak.

What should not be traded away is the principle underneath: a refusal has to mean something. If refusing consent still loads the same third party calls as accepting, the banner is theatre, the consent records behind it are hollow, and everyone in the business who has read this far knows it.

Frequently asked questions

Why are embedded videos and maps a consent problem?

Standard embed code loads the third party service immediately on page view, contacting its servers and often setting cookies or identifiers before the visitor has made any consent choice. The banner cannot undo calls that already happened.

What is two click loading?

The page shows a placeholder, such as a poster image and play button, and only loads the real embed when the visitor activates it. That activation can be tied to consent for that purpose, so nothing loads on arrival.

Do privacy enhanced video modes solve this completely?

They reduce data transfer, especially before playback, but playing the video still contacts the provider. Record precisely what loads and when rather than describing an embed as tracker free when it is not.

Will gating embeds hurt engagement metrics?

Play and interaction rates usually fall somewhat because an extra click is required. The remaining interactions are more meaningful, and the alternative is a consent refusal that changes nothing, which undermines the whole banner.