Tracking scripts loaded without consent
Google Analytics and Facebook Pixel load before any user consent is obtained.
Under GDPR Article 6, analytics tracking requires a lawful basis — typically explicit consent.
Quick fix: Delay script loading until the user accepts cookies via a consent management platform.