AUDIT.

42 cookies and 14 third-party scripts catalogued across 6 surfaces. 8 fire before the consent banner renders. 3 are not declared in the cookie policy at all.

A consent banner that fires after the cookie has nothing to consent to.

CK-019 · hotjar tracking PRE-CONSENT

_hjSessionUser_ set in <head> before banner mount.

Defer script load to post-consent, gate by consent group.