Consent checks

The free Website Consent Checker: what it tests, how to read it, what to fix.

The Website Consent Checker is a free tool that loads any page in a real browser from the EU and reports what happens before and after the visitor accepts the cookie banner. It answers the question a cookie banner alone never answers: does the site actually hold its tracking until the visitor says yes?

What one check does

  • Opens the page in a fresh headless Chrome in Amsterdam, with no cookies and no previous choice, so geo-targeted EU banners appear.
  • Records every network request and every cookie for six seconds without touching the banner.
  • Reads the consent platform (40+ CMPs by markup and script, plus the IAB TCF API), the dataLayer consent commands and Google's live Consent Mode state, including whether the default was set late.
  • Clicks the banner's accept button (known CMP buttons first, then a scored text match, including inside shadow DOM and iframes) and records what changes in the next few seconds.

A run takes about 15 to 30 seconds. Identical URLs are cached for ten minutes.

The six checks

  • Tracking before consent. Any analytics, advertising, behaviour or marketing tool that sent data before a choice. A hit that also set a cookie is a failure; a hit with no cookie we could see is flagged for review. Google's cookieless Consent Mode pings (gcs=G100) and privacy-first tools such as Plausible or Fathom are reported but never failed. Loading a library without sending anything is not counted.
  • Cookies before consent. Tracking cookies set before a choice fail (_ga, _gcl_au, _fbp, _uetsid, _hj* and 200 more signatures). Cookies from embedded players and unattributed third-party cookies are review items. Session, security and consent-choice cookies are ignored.
  • Consent banner. A visible banner passes. A consent platform that is installed but did not render for our browser is a review item. No banner with tracking present fails; no banner with nothing to consent to passes.
  • Reject is as easy as accept. A reject or "only necessary" option on the first layer passes. Accept with rejecting hidden behind settings is a review item, which is what the ICO, CNIL and the EDPB expect regulators to flag.
  • Google Consent Mode v2. Defaults denied for ad_storage, analytics_storage, ad_user_data and ad_personalization before Google tags fire passes. Only the two v1 signals, a default set after Google Tag Manager initialised, or no Consent Mode at all are flagged. Ad signals granted before a choice fail; analytics granted alone is a review item, since a few countries exempt privacy-friendly analytics.
  • Tags fire after accepting. After the click, tracking tools start sending and Google hits carry gcs=G111. Google's runtime reporting the update as granted also passes, because in advanced Consent Mode the next hit only comes with the next event.

Reading the result

The verdict is the worst of the six: a fail anywhere fails the page, a review item anywhere marks it as needing attention, otherwise it passes. Below the checks you get the evidence: every tool active before consent with what it did and an example endpoint, the cookies worth a look, what fired after accepting, and the seven Consent Mode signals before and after. Export PDF turns all of it into a branded report for whoever has to fix it, with the concrete actions and snippets.

💡 Where the fix usually is

Meta Pixel, LinkedIn Insight, Microsoft UET, TikTok and most other non-Google tags do not read Consent Mode. In Google Tag Manager, open each tag, Advanced Settings, Consent Settings, and require additional consent for ad_storage, ad_user_data and ad_personalization. Google tags only need the Consent Mode default set before the GTM snippet.

How it relates to generated containers

When you tick Consent Mode v2 in the wizard, the container TrackingCoder generates carries the consent requirement on every tag, so Meta, LinkedIn and Microsoft tags wait for the visitor's choice while GA4 and Google Ads send cookieless pings. Run the checker after publishing to confirm the banner's update reaches the tags, and again after any banner or tag change. See Consent Mode v2 for the generation side.

Limits

  • One page, one load, one location. Tags that fire on later pages, on scroll or on a click are not seen; check the pages that matter (checkout, forms, landing pages).
  • Sites behind bot protection (Cloudflare challenges, Akamai, DataDome) cannot be loaded and say so.
  • Banners the tool cannot operate (two-step choices it does not know, unusual markup) leave the after-consent check as not tested rather than guessed.
  • It is a technical observation, not legal advice. Whether a setup is lawful depends on your audience, legal basis and documentation.

Fair use

Each check runs a real browser, so the tool allows 4 checks a minute, 15 an hour and 40 a day per visitor. No signup, no credits.