Why does a consent banner reappear on a subdomain?

Usually because the consent cookie was set as host only, so other subdomains cannot read it, or because the CMP is configured differently on that host. Each subdomain looks correct alone, which is why a cross domain test with one browser session is needed to find it.

What cookie scope lets subdomains share consent state?

The consent cookie generally needs its domain attribute set to the registrable domain, with appropriate path and security flags, so sibling subdomains can read it. Exact configuration depends on your CMP and security policy, and should be tested in production.

Should every subdomain show the same banner?

The experience should be consistent, but the key requirement is shared state, not identical pixels. A visitor's recorded choice and preferences must be readable and honoured on every host they reach in a session.

How often should cross subdomain consent be audited?

After any CMP, checkout, or domain change, and on a recurring automated check. Deployments on a single host are the common trigger for a break that only appears when a visitor crosses between subdomains.

Auditing Consent on Account and Password Reset Pages

November 1, 2026

Audits test the storefront and skip the account area, where support widgets, analytics, and session tools load for signed-in customers. What to check behind the login.

Consent audits have a blind spot shaped exactly like a login form. The audit runs on the homepage, a category, a product, maybe the checkout, all as a signed out visitor. The account area, order history, address book, password reset flow, is a different set of templates with a different set of tools loaded, and for many stores it has never been in a consent test at all.

Signed-in pages are not exempt pages. The shoppers there are your most identified customers, which makes unconsented tracking of them worse, not better, and the tooling there, support chat with session context, account analytics, loyalty platforms, is often richer than anything on the storefront.

What loads behind the login

Test it the way the storefront gets tested: a clean profile, consent refused, then sign in and walk the account area page by page, recording requests and cookies. Expect surprises. Account templates are often older than the storefront theme, built before the consent platform existed, with tags placed directly in the template rather than through the gated tag manager. Support and loyalty tools are common culprits because they were installed to solve a service problem, by the service team, with nobody routing the install past whoever owns consent.

Password reset deserves its own line in the audit. The flow leaves the site for email and returns through dedicated templates that marketing rarely sees. Reset pages have carried analytics and even advertising pixels inherited from old themes. A customer resetting a password after a scare about their account is the single worst audience for unexplained tracking, and the reset confirmation page is also a classic spot for a tag that was meant for the order confirmation page and got pasted into the wrong template.

Consent state has to survive signing in

The second check is continuity. A shopper who refused consent as a visitor, then signs in, should still be refused. Platforms that key consent to an account profile can merge or overwrite the anonymous choice at login, and the merge logic was written for convenience, not for the principle that a refusal is a refusal. Test the combinations: refuse then sign in, sign in then refuse, and refuse on a second device while signed in on the first. Where the state lands after each is a finding, whichever way it falls.

The same applies to preference centres. If the account area offers privacy preferences, what they show must match the consent record the banner holds. Two systems keeping two versions of a customer's choice is a complaint waiting for its screenshot.

Add the account area to the audit template

The fix is procedural. The audit page list grows: account dashboard, order history, order detail, address book, password reset request and confirmation, and the preference centre, each in refused and given states, with the test account's activity included in the request logs. It adds an hour to an audit and removes the largest untested surface most stores have. Assign the test account an owner and keep its credentials with the audit kit, because the commonest reason account pages get skipped next time is that nobody could sign in on the day.

Frequently asked questions

Why are account pages missed in consent audits?

Audits typically run signed out because that is how the banner team tests the storefront. Account templates are often older, with direct tags and separately installed support and loyalty tools that were never routed through consent gating.

What should a behind-login consent audit check?

Every account page, dashboard, orders, addresses, preference centre, plus the password reset flow, in refused and given consent states, recording third party requests and cookies on each.

Can signing in overwrite a consent refusal?

It can, where the platform merges anonymous consent into an account profile at login. Test refuse then sign in, sign in then refuse, and cross device combinations to see where the state actually lands.

Why does the password reset flow matter?

It uses separate templates that rarely get reviewed and have historically inherited stray analytics or advertising tags, shown to customers at their most security conscious moment.