Published August 15, 2026 · 8 min read · RegSentry blog
Here's a pattern we see constantly: a business gets its website audited, fixes everything, and files the report away as "done." Months later, a scan of the same site finds trackers firing before consent again — tools that weren't in the audit, added by nobody in particular, gated by nothing. Nothing failed and nobody was careless. The site simply did what websites do: it changed. This article is about how that happens, mechanically, and why the shelf life of a tracking audit is shorter than almost anyone assumes.
A tracking audit answers one question with precision: what did this site transmit, relative to consent, on the day we looked? That answer is genuinely valuable — it's the baseline everything else builds on. But "compliant" isn't a property a site acquires and keeps, like an SSL certificate you renew annually. It's a description of current behavior, and the behavior changes every time anyone — or anything — touches the tracking stack. The audit stays accurate; the site stops matching it.
Google Tag Manager exists precisely so marketing can ship tags without a code deploy — which also means tags ship without the review that a code deploy gets. A marketer or agency adds a campaign pixel, clicks Publish, and your site's tracking posture changes that minute. Unless every new tag is configured with consent requirements (and in most containers, nothing enforces that), the new tag fires ungated from day one. The audit that cleared your container six months ago examined tags that existed six months ago.
On WordPress, Shopify, and every other platform, updates routinely change what a site loads. A plugin update ships a new "insights" feature that phones home. A theme update re-adds a snippet you removed by hand (because your removal was an edit to a file the update replaced). An app you installed for reviews quietly adds an analytics beacon. None of this announces itself — the site looks identical, and only the network log differs.
Someone trials a chat widget for a quarter. Marketing connects a store to a new ad channel, and the channel app injects its pixel automatically — outside your theme, outside your tag manager, outside whatever your consent platform gates. The trial ends; the script often stays. Integration-injected trackers are a special problem because they never pass through the place where your consent gating lives, so even a well-configured setup doesn't catch them.
Some tags load other tags. Advertising tags especially can chain-load additional vendors' scripts, so your network log grows without anyone at your company adding anything at all. You approved one vendor; you're now serving several.
Put the four channels together and drift stops looking like a rare event and starts looking like a schedule. A typical small-business site sees plugin or app updates monthly (often automatic), a tag-manager publish whenever a campaign launches or an agency optimizes something, and a new integration every time a tool gets trialed — each one a fresh roll of the dice on consent gating. The dice don't have to come up badly often. One ungated addition per year is enough to spend most of every year out of compliance with your own audit, because the gap runs from the day the tracker appears until the day someone looks — and on a site nobody re-checks, "the day someone looks" may be the day a letter arrives. This is also why the fix can't be "be more careful": most of the changes above are made by software or by people outside your review loop. You can't approve changes you never see; you can only detect them.
The demand-letter math from the pre-consent tracking wave turns on time: plaintiffs argue each affected visitor session is a separate violation (CIPA's § 637.2 sets statutory damages up to $5,000 per violation), so exposure accumulates from the day an ungated tracker appears — not from the day you notice it. A tracker that slipped in during a March tag publish and gets discovered in a November letter has been accumulating sessions for eight months. Your audit from February is true and also beside the point.
The same clock runs in reverse once you catch things quickly. A dated clean baseline, a dated detection of the new tracker, and a dated fix days later is a strong good-faith record — and a short window means small numbers. Speed of detection is the whole game.
The fix for drift isn't auditing harder — it's re-checking on a cadence that matches how fast the site changes. Concretely, a monitoring loop does four things:
If you'd rather run this yourself, you genuinely can: calendar a monthly re-verification (the ten-minute browser check), plus an extra check after every tag publish, plugin update, and new integration. The discipline that's hard to sustain manually is the "after every change" part — changes made by other people, plugins, and platforms don't ask you first, which is exactly why we built the automated version.
If the last answer is "we'd find out when someone tells us," that someone is increasingly likely to be a law firm's scanner rather than your own.
Start with a fresh photograph: the free scan shows you exactly what fires on your site before consent today — and if you want the re-checking, diffing, and alerting handled for you from then on, that's precisely what monitoring does.
See what fires on your site before visitors consent — free, 30 seconds, no signup.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.
If you'd rather have the site watched continuously — with an email the moment a new tracker appears — that's what monitoring is for ($99/mo, cancel anytime).