A cookie banner makes a promise to visitors. A consent audit checks whether your tags keep it. This is the highest-stakes part of any tracking audit: the difference between compliant and exposed, and where the most setups fail. Eight checks, the failures they find, and how to run them by hand or automatically.
Consent is 30% of a Tracking Auditor score, the highest-weighted dimension. See how yours holds up: your first audit is free.
Run a free audit →Private window, DevTools → Network, filtered to google-analytics.com, googletagmanager.com, doubleclick.net and your other tag domains. Load the site and do nothing. Any collect or conversion request that fires before you've interacted with the banner is unconsented tracking. This is the most common failure, and the one regulators and enterprise procurement check first.
In the console, inspect window.dataLayer. There must be a consent default entry, denying analytics_storage and ad_storage, that appears above any config or event call. Consent Mode set after tags load protects nothing: the tags have already fired by the time the denial arrives.
V2 added ad_user_data and ad_personalization, and Google requires both for EEA ad features. If the consent default only sets ad_storage and analytics_storage, the setup predates March 2024 and Google Ads audience and measurement features are degraded without any warning shown.
Accept, reject, and ignore. After rejecting: no analytics cookies (_ga, _gid), no collect requests carrying full identifiers. After ignoring: same as rejecting. Most broken setups pass the accept path and fail the other two, because accept is the only path anyone ever tested.
In GTM, each tag has consent settings (Advanced → Consent Settings). Google tags handle Consent Mode natively. Third-party tags (Meta, TikTok, LinkedIn, Hotjar) do not, and need explicit additional consent checks or blocking triggers. A container where only the Google tags respect consent is a container that leaks.
A paused CMP tag, or one broken by a template update, means no consent signals reach anything, while the banner itself may still render from cache. The banner showing proves nothing; the dataLayer consent update event is what matters.
DevTools → Application → Cookies, after each consent path. Every cookie set should appear in the banner's declaration, in the right category. Ad cookies classified as 'strictly necessary' and cookies that predate consent contradict the compliance story in writing.
Consent granted on www must carry to shop. and app. if they share tags, and single-page apps must re-check consent on virtual pageviews, not just the first load. Cross-domain setups are where otherwise-correct implementations fall apart.
The same six failures come up again and again, usually in setups whose owners believed they were compliant because a banner was showing.
The banner renders while GA4, Meta and the rest are already collecting. Compliant-looking, non-compliant in fact.
The default arrives after the config call, so Google's tags run unconsented on every first pageview.
Accepting works; rejecting is visually acknowledged and functionally ignored.
Google tags wait while Meta and TikTok fire regardless. Consent Mode only governs tags that listen to it.
Someone paused the consent tag during debugging and never re-enabled it. No signals since.
Tags added since the banner was configured set cookies the declaration has never heard of.
Consent is one of five dimensions in a complete tracking audit. The full process is in the Google Analytics audit guide. The container-side review lives in the GTM audit guide, and the revenue side in the conversion tracking audit guide. For the condensed to-do-list version, use the GA4 audit checklist.
A consent mode audit verifies that a website's tags actually respect visitor consent: that Consent Mode v2 defaults are set before any tag fires, that accepting, rejecting and ignoring the banner each produce the correct behaviour, and that the cookies really set match what the consent banner declares.
Open the site in a private window with DevTools. Inspect window.dataLayer for a consent default entry (including ad_user_data and ad_personalization) appearing before any config calls. Then test all three paths (accept, reject, ignore) and confirm network requests and cookies behave differently in each.
No. Consent Mode is a signalling mechanism for Google's own tags: it tells them what the visitor chose. Compliance depends on the choice being collected properly, enforced across all tags including non-Google ones, and reflected accurately in your cookie declarations. Many sites with Consent Mode installed still fail a consent audit.
GDPR markets require opt-in: analytics and ad tags must not fire until the visitor consents. Most US state laws (CCPA and successors) allow tracking by default but require a working opt-out. An audit checks the setup against the regimes that actually apply to your traffic.
Yes. Tracking Auditor reads your GTM container and GA4 property and checks consent configuration across every tag (Consent Mode defaults, per-tag consent settings, CMP presence, cookie classification) as the highest-weighted dimension of a full scored audit, worth 30% of the grade.
Tracking Auditor checks Consent Mode configuration, per-tag consent settings, CMP presence and cookie classification across your live GTM and GA4: scored, explained, and prioritised. Your first audit is free, no card required.
Run your free audit