My analysis
1
glg.com: Google Analytics and Google Ads track visitors prior to consent due to §4- 3 scripts in Webflow bypass OneTrust entirely due to §5.
glginc.cn violates China PIPL due to §8.
2
glg.com fails consent withdrawal: OneTrust does not delete cookies after rejection (§6).
3
glg.com ignores the Global Privacy Control signal (§7).
4
glg.com initializes Google Tag Manager (GTM-MWCHK79) before OneTrust determines geolocation and applies rules: gtag('consent', 'default', ...) is absent from the <head> before GTM.
4.1
window.google_tag_data.ics confirms that Google tags execute with:
{
"usedDefault": false,
"usedImplicit": true
}
4.2
Due to §4.1, Google Analytics (G-7FTWEZ93WS) and Google Ads (AW-662853930) write persistent cookies (_ga, _ga_7FTWEZ93WS, _gcl_au) and send network beacons upon page load before consent.
4.3
Even under German IP (GDPR + LGDP Audience), outgoing Google hits transmit:
gcd=13l3l3l2l1l1 where l indicates that consent is «unspecified» by default → violates GDPR Art. 4(11) and ePrivacy Directive Art. 5(3).
developers.google.com/tag-platform/security/guides/consent#default-consent
4.4
When OneTrust later sends a consent update, the Google tag engine marks it "wasSetLate": true.
support.google.com/analytics/answer/14275483?hl=en#check
5
3 scripts embedded in Webflow templates bypass OneTrust:
5.1
Intellimize (https://cdn.intellimize.co/snippet/117279289.js): lacks OneTrust blocking attributes (type="text/plain" class="optanon-category-C0004"), immediately transmitting user telemetry to:
https://api.intellimize.co/prediction/117279289https://log.intellimize.co/logger
5.2
Salesforce Customer 360 / Data 360 (https://cdn.c360a.salesforce.com/beacon/c360a/741eb827-80ca-47ba-b723-4cdef39de9d0/scripts/c360a.min.js): sets the _sfid_836c cookie on page load and streams events to *.c360a.salesforce.com.
5.3
Marketo Munchkin: executes Munchkin.init("561-YYM-489") unconditionally, creating the _mkto_trk cookie.
6
Clicking «Reject All Cookies» on glg.com does not delete tracking cookies:
6.1
OneTrust does not delete cookies out of the box; cookie deletion logic in OptanonWrapper is not implemented → _ga, _ga_7FTWEZ93WS, _gcl_au remain in browser storage.
my.onetrust.com/s/article/UUID-b2d72003-853b-e75b-e337-c6d26ea327eb
6.2
Microsoft Clarity (https://t.clarity.ms/collect) and Salesforce Data 360 continue streaming session telemetry after rejection.
7
glg.com ignores Global Privacy Control: when navigator.globalPrivacyControl = true, OneTrust sets isGpcEnabled=0&browserGpcFlag=0 in the OptanonConsent cookie → violates 11 CCR § 7025 (CCPA/CPRA).
8
glginc.cn operates on a separate stack (Gridsome, GTM-KKW3RM3) and violates China PIPL:
8.1
OneTrust is frozen on version 6.27.0 (December 20, 2021).
8.2
There is no rule for China in OneTrust: Chinese visitors fall into Global (CN), where all cookie categories (C0001–C0005) are active by default (opt-out).
8.3
The banner (zh.json) has no reject button (AlertRejectCookiesText: undefined) → violates PIPL Art. 14 (mandatory prior opt-in consent).
8.4
OptanonWrapper() is an empty stub:
function OptanonWrapper() { }
8.5
Baidu Tongji (https://hm.baidu.com/hm.js?c024633369ff38507add2a8a57964d14): loaded with standard type="text/javascript", firing pre-consent because C0004 is active by default in OneTrust.
8.6
Dead Universal Analytics (UA-47764303-4) is hardcoded in app.72a39ae5.js and sends failing collection requests to https://google-analytics.com/j/collect?v=1.
8.7
LinkedIn Insight Tag tries to connect to https://px.ads.linkedin.cn/, fails with SSL/CORS errors, and loops LinkedIn's error tracking beacon (insight_tag_errors.gif).
9. «If OneTrust and GTM appear correctly configured, but you discover a cookie or tracking request firing before consent, how would you troubleshoot it and identify where it's coming from?»
9.1
Check the «Initiator» call stack in Chrome DevTools «Network» tab: trace whether the request originates from gtm.js (a GTM tag) or a standalone script (CMS template code).
9.2
Check DOM: verify whether script tags have OneTrust blocking attributes (type="text/plain" class="optanon-category-C000X").
Standard type="text/javascript" scripts execute synchronously during HTML parsing before OneTrust can block them.
9.3
Check GTM Preview: inspect Consent Initialization vs gtm.js. Verify whether tags lack consent checks or trigger on All Pages instead of OneTrustGroupsUpdated.
9.4
Check runtime: inspect window.OnetrustActiveGroups and OptanonConsent cookie.
If groups are 1 on first load, the geolocation rule is set to opt-out instead of opt-in.
Check window.google_tag_data.ics for missing default command.
9.5. Where it is coming from on your websites
9.5.1
glg.com: Intellimize (snippet/117279289.js) and Salesforce (c360a.min.js) are hardcoded in Webflow outside GTM; Google tags inside GTM-MWCHK79 fire because gtag('consent', 'default') is missing before GTM.
9.5.2
glginc.cn: Baidu Tongji fires because C0004 is active by default in OneTrust's Global (CN) rule.
10. «How you would audit and validate the Google Consent Mode v2 consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) and make corrections if needed?»
10.1. Audit & validation
10.1.1
Check window.google_tag_data.ics: ensure usedDefault is true, usedImplicit is false, and wasSetLate is false.
10.1.2
Decode the gcd parameter in network requests to analytics.google.com/g/collect and googleads.g.doubleclick.net:
- Prior to consent (opt-in):
gcd=13p3p3p3p1l1 (denied by default, cookieless pings).
- After «Accept All»:
gcd=13r3r3r3r1l1 (granted by update).
- After «Reject All»:
gcd=13m3m3m3m1l1 (denied by update).
glg.com currently sends gcd=13l3l3l2l1l1 (unspecified fallback, "wasSetLate": true).
10.1.3
Validate states in GTM Tag Assistant across gtm.init_consent and OneTrustGroupsUpdated.
10.2. Corrections for your websites
10.2.1
Add the default snippet at the very top of <head> before GTM:
window.dataLayer = window.dataLayer || [];
function gtag() { dataLayer.push(arguments); }
gtag('consent', 'default', {
'analytics_storage': 'denied',
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'wait_for_update': 500
});
10.2.2
Implement OptanonWrapper to push consent updates and the OneTrustGroupsUpdated event:
function OptanonWrapper() {
var activeGroups = window.OnetrustActiveGroups || '';
var a = activeGroups.indexOf(',C0002,') !== -1;
var m = activeGroups.indexOf(',C0004,') !== -1;
gtag('consent', 'update', {
'analytics_storage': a ? 'granted' : 'denied',
'ad_storage': m ? 'granted' : 'denied',
'ad_user_data': m ? 'granted' : 'denied',
'ad_personalization': m ? 'granted' : 'denied'
});
window.dataLayer.push({ event: 'OneTrustGroupsUpdated' });
}
10.2.3
In GTM-MWCHK79 and GTM-KKW3RM3, route non-Google tags through OneTrustGroupsUpdated with category checks.
10.2.4
Add OneTrust blocking classes to Webflow custom code (Intellimize, Salesforce).
10.2.5
On glginc.cn, configure a PIPL opt-in rule with a reject button, remove dead Universal Analytics, and fix the LinkedIn endpoint.