A visitor lands on a Shopify store. Before the page has painted, before the cookie banner exists, before there is anything to click — data is already leaving. This instrument replays those milliseconds.
No store in mind?
You agreed to none of it. There was no banner.
Everything above was derived from your browser while you were reading about somebody else's store. No permission was requested, because none is required. This is the ordinary capability of any page you open, anywhere, including this one.
There is exactly one difference between this page and the trackers in the timeline above, and it is not technical sophistication. It is this: none of it left your browser. Not one byte was transmitted. There is no endpoint, no collection, no record — open your network tab and check. Nothing about you appears there, because nothing about you was sent.
Their version of this ran before you could have said no. Then it was uploaded.
Most consent tools report a leak whenever a tag exists. That is why merchants stop believing them. Airlock sorts every tag it finds into exactly one of four states, and the sorting is the product — a report that calls a correctly-gated tag a violation is worse than no report, because the next real finding gets ignored too.
The tag carries a real blocking attribute. It cannot fire before consent, and nothing needs doing.
A consent platform is gating it, and gating it correctly. Counting this as a leak is the single most common error in this category.
Ungated, and fixable by you. It is in your theme or your tag manager, where a consent manager can reach it.
Ungated, and no consent app can fix it. Shopify rendered it into the HTML on the server, before any JavaScript existed to intervene. This is the one Airlock was built for.
Not by trying to out-run the preload scanner — nothing wins that race. By changing what the server emits in the first place.
It reads the app block exactly as Shopify rendered it and writes a typed manifest into its own app metafield — including the block's other scripts, the ones that install globals and rewrite account links. A gate that rebuilds only the fetching script silently breaks the rest.
Each tag comes back as type="text/plain" with the real URL parked in
data-src. The preload scanner finds nothing to fetch, because there is
nothing to fetch.
The loader swaps the inert tags for live ones the moment Shopify's own Customer Privacy API reports consent for that category — per category, not all-or-nothing.
Agencies and Plus partners can paste up to fifty storefronts and get one board: which clients are leaking, which have trackers no consent app can reach, and — on the second run — which ones got worse since last month. White-labelled, printable, one link per client.
Installing asks for read_themes and
nothing else. Airlock never requests customer data, because it never needs any.