Cookie Consent Checker: How to Test Your Cookie Banner Like a Regulator Would

Having a cookie banner is the easy part. What regulators and privacy lawyers look at is what your site does underneath the banner: which trackers load before a visitor chooses anything, and whether clicking Reject actually stops them. Consent-testing tools consistently report that the most common failure is a banner that displays fine while analytics and ad tags fire on page load. You can test for that yourself in about ten minutes.

Test 1: What loads before any choice

1. Open a private or incognito window so you start with no cookies.
2. Press F12, open the Network tab, and tick "Preserve log".
3. Load your homepage and don't touch the banner.
4. In the Network filter, search for common tracker domains: google-analytics, googletagmanager, facebook, tiktok, clarity.ms, hotjar, linkedin, doubleclick.
5. Then open the Application tab (Storage in Firefox), and look at Cookies. Cookies like _ga, _fbp, or _gcl_au already set means tracking started before consent.

Under the EU's GDPR and ePrivacy rules, non-essential cookies need opt-in consent before they're set. Strictly necessary ones (cart, login session, the cookie that stores the visitor's choice) are fine.

Test 2: Does Reject work?

Open a fresh private window, load the page, click Reject (or "Only necessary"), and repeat the checks above. Anything from the tracker list that keeps loading after Reject is a problem, and it's a common one, since many sites hard-code a pixel in the theme header where the consent tool can't block it.

Test 3: Is refusing as easy as accepting?

European regulators expect a Reject option on the first layer of the banner, next to Accept. A banner that only says "Accept" or "Settings", or buries Reject two clicks deep, is a warning sign. Pre-ticked boxes don't count as consent.

Test 4: U.S. visitors and Global Privacy Control

U.S. state laws like California's CCPA/CPRA mostly work on opt-out rather than opt-in, but several states expect you to honor the Global Privacy Control (GPC) signal as an opt-out of selling or sharing data for ads. Browsers like Brave send it by default. If you run ad pixels, check whether your consent tool has a GPC setting and that it's turned on. If you sell or share data for advertising, you also need a "Do Not Sell or Share My Personal Information" link.

Fixing what you find

• Trackers fire before consent: load them through your consent tool or Google Tag Manager with consent triggers, not pasted straight into the theme. Make sure the consent tool's script loads before GTM.
• Using Google Ads or GA4 with EU traffic: turn on Google Consent Mode v2 in your consent tool, which sets ad and analytics storage to "denied" until the visitor accepts.
• Pixel added by a plugin or app: WordPress plugins, Shopify apps, and Wix or Squarespace integrations often inject tags directly. Check each one's settings for a "wait for consent" option.
• No banner at all: if you use any analytics or ad tags and get EU or UK visitors, add a consent tool. Free tiers from the main providers cover most small sites.

Re-test after every theme, plugin, or app update, since updates often put tags back. And make sure your privacy policy names the tools you found; see our privacy policy checker guide.

This guide is general information, not legal advice.

Check it the fast way

Want a second opinion in under a minute? Scan your site free with SiteShield. It checks whether a cookie notice or consent tool is present on your homepage and whether a privacy policy is linked, plus HTTPS, security headers, SPF, and DMARC and shows your score and every issue found. If you'd rather skip the trial and error, the $14 fix bundle gives you copy-paste fixes written for your exact site.

Check your site free