Why does a consent banner reappear on a subdomain?

Usually because the consent cookie was set as host only, so other subdomains cannot read it, or because the CMP is configured differently on that host. Each subdomain looks correct alone, which is why a cross domain test with one browser session is needed to find it.

What cookie scope lets subdomains share consent state?

The consent cookie generally needs its domain attribute set to the registrable domain, with appropriate path and security flags, so sibling subdomains can read it. Exact configuration depends on your CMP and security policy, and should be tested in production.

Should every subdomain show the same banner?

The experience should be consistent, but the key requirement is shared state, not identical pixels. A visitor's recorded choice and preferences must be readable and honoured on every host they reach in a session.

How often should cross subdomain consent be audited?

After any CMP, checkout, or domain change, and on a recurring automated check. Deployments on a single host are the common trigger for a break that only appears when a visitor crosses between subdomains.

Auditing Consent on Password Reset, Account Creation, and Other Quiet Flows

November 3, 2026

Preference centres get audited. Account flows do not, and they load trackers, set marketing defaults, and bundle consents into a checkbox nobody reads. Where to look.

Nobody audits the password reset page. It is a utility, it has no campaign on it, and it is not in the sitemap anyone reviews. It also loads the same template as the rest of the site, which means it loads the same analytics, the same support chat, and often a marketing tag, all presented to a visitor who is in the middle of a security sensitive task and in no position to be making considered choices about tracking.

Account creation is the richer target. In a few fields and one button, a site can collect an email address, set a marketing preference by default, agree the visitor to terms and a privacy notice in a single bundled checkbox, and fire a set of tags on the confirmation page. Each of those is a separate decision that deserves a separate look.

Separate the consents that are being bundled

Creating an account requires agreeing to the terms that govern the account. It does not require agreeing to marketing emails, to the sale or sharing of personal information, or to non essential cookies, and bundling those into one I agree checkbox collapses choices the rules treat as distinct. In the United States the framing is opt out rights and honoring signals such as Global Privacy Control. Under European rules the point is sharper still: consent bundled into a contract it is not necessary for is difficult to defend as freely given.

Audit the form field by field. Is the marketing box present, is it unticked by default, is its label specific about what the emails are and how often they come, and can the account be created successfully with it left unticked? That last test is the one that reveals the truth, because a form that errors unless the marketing box is ticked has answered the legal question in the worst available way.

Trackers on sensitive pages

A password reset flow reveals, by its existence, that a person has an account and is having trouble with it. Sending that page view, with a reset token in the URL, to analytics and advertising platforms is a data leak wearing a routine configuration. Check whether reset and verification URLs carry tokens as query parameters that then appear in page URLs reported to third parties, and whether the consent configuration on those templates matches the one on the marketing pages.

The same applies to the logged in account area generally. Consent choices made as a guest should persist and be honored after login, and a fresh set of tags should not appear simply because the template changed when the visitor authenticated. A visitor who refused non essential cookies and then logs in has not changed their mind by logging in.

Confirmation pages and the welcome email

The page after account creation and the welcome email are where stated preferences meet actual behaviour. If the marketing box was left unticked, does a welcome sequence still arrive, reclassified as a service message? Does the confirmation page load a pixel that adds the new account holder to an advertising audience, despite the cookie refusal recorded a minute earlier?

Read the welcome email's own footer and preference links with the same suspicion. An unsubscribe that works, a preference centre that reflects the choices made at signup, and a record of those choices that can be produced later are the closing pieces of the flow. An audit that stops at the form has audited the promise and skipped whether it was kept.

Frequently asked questions

Why audit account and password reset pages for consent?

Because they run the same templates and trackers as the rest of the site, often on security sensitive steps, and account creation bundles several distinct choices, marketing, terms, cookies, into one flow that rarely receives a consent review.

Can marketing consent be bundled into account creation terms?

It should be a separate, unticked choice that is not required to create the account. Bundling marketing agreement into a general I agree checkbox collapses decisions that privacy rules treat as distinct.

What is the risk with password reset URLs and trackers?

Reset URLs often contain tokens as query parameters, which can be sent to analytics and advertising platforms as part of the page URL. That discloses account and reset information to third parties by routine configuration.

Should a cookie refusal carry over after a visitor logs in?

Yes. Logging in is not a change of consent. The refusal recorded as a guest should persist in the account area, and new tags should not appear merely because the template changed on authentication.