Consent Mode and cookie banners: why a banner is not a tracking audit

Many websites now have a cookie banner. That does not automatically mean tracking is controlled correctly. A banner is only the visible surface. Underneath are tag managers, marketing pixels, analytics scripts, Consent Mode, local storage, embedded media, and often several plugins that all need to work in the right order.

The common failure is simple: the banner asks for consent, but some scripts already run before the choice. The interface looks correct to users. Technically, the opposite may be true.

Checking the banner is not enough

A real cookie and tracking check should cover at least three layers:

1. Interface: are accept, reject, settings, and category choices understandable and reachable?
2. Technology: which cookies, local storage entries, and network requests appear before and after the choice?
3. Configuration: how are the consent tool, tag manager, and individual tags connected?

Consent Mode is often misunderstood. It does not replace consent. It is a technical control that allows Google tags to adapt behavior based on consent signals. If the signal is set incorrectly, a polished banner does not fix the setup.

Common website project mistakes

Audits often show the same patterns:

• Analytics loads on the first page view.
• Marketing pixels fire despite rejection.
• YouTube, Maps, or chat widgets send external requests before consent.
• The tag manager contains old tags nobody recognizes.
• Consent categories in the banner do not match tag manager logic.
• A plugin loads scripts outside the consent tool.
• The reject button exists, but the technical behavior is not equivalent.

This is rarely intentional. It usually happens over months: one new plugin, one campaign, one relaunch, one pixel. Nobody checks the combined behavior afterwards.

Practical audit steps

A repeatable tracking check can look like this:

1. Use a clean browser profile or incognito session.
2. Load the page without consent and inspect network requests.
3. Document cookies and local storage before any choice.
4. Test rejection and inspect requests again.
5. Enable individual categories and compare behavior.
6. Use Tag Manager Preview if available.
7. Test key pages: contact, checkout, booking, blog, landing pages.
8. Check external embeds separately.

Important: do not only test the homepage. Tracking is often implemented differently on landing pages, forms, or checkout flows.

Maintenance, not a one-time project

Cookie setups age quickly. New campaigns, plugins, and tools can change behavior. Consent therefore belongs in maintenance:

• Test after every new marketing tag.
• Check after plugin updates.
• Run a short cookie scan once per quarter.
• Clean up tag manager leftovers.
• Keep consent documentation current.

Conclusion

A cookie banner is not proof that tracking is controlled correctly. What matters is what happens technically. A good website check therefore reviews interface, network requests, and tag configuration together.

Sources

• Google Tag Platform: Consent mode overview
• Google Tag Platform: Set up consent mode
• EDPB Guidelines 05/2020 on consent

Note: This article is a technical overview and does not constitute legal advice.