Tracking cookie is set on the first response
An analytics or advertising tracking cookie is set by the server on the first response, before the visitor has interacted with the page or made any consent choice.
Why it matters
An analytics or advertising tracking cookie is set by the server on the first response, before the visitor has interacted with the page or made any consent choice. Cookies of this kind usually require prior consent in the EU/EEA and UK, so setting one on initial load is a common gap. Set such cookies only after the visitor opts in. (The specific cookie and vendor are named in this finding's evidence.)
How ShipReady detects it
Per-page privacy signals read straight from the fetched HTML and response headers — no extra requests. Page-scoped because trackers, cookies and forms genuinely differ between routes (a marketing homepage vs a bare /login), and the route that carries the signup form is exactly the one worth seeing.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
The cookie affected is an analytics/advertising tracking cookie set on the first response, before the visitor has interacted with the page or chosen whether to accept cookies. Set cookies of this kind only after the visitor opts in: initialise the analytics or advertising SDK from your consent callback rather than on page load, and confirm nothing writes the cookie server-side before consent. Strictly-necessary cookies (session, CSRF, load-balancing) are exempt and do not need to wait.
Frequently asked questions
- What does "Tracking cookie is set on the first response" mean?
- An analytics or advertising tracking cookie is set by the server on the first response, before the visitor has interacted with the page or made any consent choice.
- How serious is it?
- ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
- A device-fingerprinting script is presentmedium
- A form collecting personal data submits via GETmedium
- Session-replay or behaviour-recording script is presentmedium
- Tracking cookie is set before the consent banner can be answeredmedium
- Analytics or advertising tracker loads without a detected consent steplow
- Fonts are loaded from Google's serverslow
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.