Holiday Tag Freeze: Audit New Pixels Before Black Friday

Every November, marketing adds tags. A retargeting pixel for the Black Friday campaign, a new affiliate script, a loyalty widget that someone promised would be live by the 27th. Your last privacy audit was done before any of them existed.

Why the freeze matters

Black Friday falls on November 27 this year, and Cyber Monday on the 30th. Most engineering teams stop shipping code in the days before; tag managers often stay open, because publishing a container doesn't feel like a deploy. That gap is where new advertising and analytics pixels reach production without anyone checking whether they respect a visitor's opt-out.

The stakes are higher than usual because the traffic is. A pixel that ignores Global Privacy Control sends the same data on a quiet Tuesday and on Cyber Monday; there are just far more California visitors for it to affect. And CalPrivacy's draft opt-out signal rules, scheduled for discussion at its November 5–6 board meeting, would treat a pixel that fires before your consent tool checks for GPC as a failure to opt out as soon as feasibly possible. Nothing is final, but it describes the exact setup a rushed holiday tag tends to create.

What to do before the freeze

Start with an inventory. Open your tag manager and list every tag added or edited since your last audit, including ones a contractor or an agency published. Anything you can't attribute to a person and a purpose is a candidate for removal.

Then test the site the way a California visitor with GPC turned on would see it. Load your homepage and a product page in a fresh browser profile, open the network panel before the first request, and look for advertising and analytics hosts that load regardless of the banner or the signal. Our pre-consent firing check walks through the steps. Repeat with the banner declined. If a new host appears in either run, find out which tag loaded it and whether it can be gated behind the consent tool.

Watch for the quiet ones, too. A tag you vetted can load a second vendor's script on its own, which is how pixels end up on a page that no one approved; the shadow pixels write-up covers why a consent platform won't always catch these. Finally, publish nothing to the container between your last clean test and the weekend itself, or retest after every change.

Where Privisy fits

A full Privisy audit loads your site with and without the GPC signal and records the advertising and analytics requests each visit makes, so a pixel added last week shows up as a finding instead of a surprise. It sees browser-side requests only; what your vendors do with the data afterward is a question for them. Running one scan after the tag list is final, and another after any late change, takes less time than the meeting about the campaign.