Is the consent check free?

Yes. You can test one public URL and see the preview without an email address. A work email unlocks the full report with fixes and the cookies and tracking providers recorded. We also send the report by email.

How does the consent check work?

Our agent visits your website and performs a series of assessments and checks of consent and tracking. You receive a report with the findings and suggestions for improvement.

Do all cookies require consent?

No. Technology strictly necessary for a service the user requests can be exempt. Assess the function, not just the category name. A cookie does not become necessary because a supplier or business labels it that way.

Is a cookie banner enough to comply with GDPR?

No. Information, meaningful choices and technical handling need to match. GDPR also sets requirements for your wider processing of personal data, beyond what a banner or this test can check.

Is Google Consent Mode v2 the same as consent?

No. It is a technical way to communicate a choice to Google tags. It does not collect valid consent by itself or automatically configure other providers' tracking.

Does server-side tracking need consent?

Moving tags to a server does not remove consent requirements applicable to the underlying tracking. Assess access to the user's device and processing of personal data. This check cannot see all data forwarded by your server.

What does the report's score mean?

The score summarises the test's technical checks. Read the findings and scope alongside the number. A high score does not guarantee lawfulness, and each finding needs to be considered in the context of your setup.

Does the check change my website?

No. The agent assesses your website without changing its code, content or settings.

How often should we run a cookie check?

Repeat the check after changes to your consent platform, GTM, analytics tools, plugins or landing pages. Schedule regular checks too, so new tags do not go unnoticed.

Free consent checker: test cookies and tracking

01What the tool does

What is a consent check?

A consent check examines how your website handles consent to cookies and other tracking. A cookie banner can look correct while Google Analytics, Meta Pixel or other tags start before the visitor makes a choice. That is why you need to check what the browser actually does, as well as the banner's wording.

The check sees your website the way a new visitor meets it, and shows whether tracking respects the choice the visitor makes. The result covers the cookie banner, cookies and other storage, third-party tracking and Google Consent Mode v2.

You receive a free preview without providing an email address. The full report includes findings, suggested fixes and the cookies and tracking providers recorded. A work email unlocks it and sends a copy to your inbox. Use the report as a practical starting point for your developer or Google Tag Manager administrator.

02Consent requirements

When do cookies and tracking need consent?

In the EU/EEA, national rules implementing the ePrivacy Directive regulate storing or accessing information on a user's device. These rules extend beyond cookies. Where consent is required, it must meet the GDPR standard: freely given, specific, informed and unambiguous. Check the rules that apply to your market.

An active choice: Visitors must choose for themselves. Pre-ticked boxes, silence or continued browsing do not provide valid consent.
Understandable information: Explain the purposes of tracking and who uses the information. A vague reference to a “better experience” is not enough.
Choices by purpose: Consent must relate to specific purposes. Separate analytics from marketing, for example, so visitors can choose what they want.
A real option to say no: Rejecting should be as easy as accepting. Do not hide rejection behind extra clicks or make it harder to find.
Consent before relevant tracking: Technologies that require consent must be managed before storing or accessing information. The banner needs to control the tags.
The ability to change your mind: Withdrawing consent must be as easy as giving it. Keep consent settings accessible.

Your organisation must be able to demonstrate consent; this test does not check consent logs. A limited exemption applies to technology strictly necessary to provide a service the user explicitly requests, and to transmitting communications. Analytics or advertising being useful to a business does not make it strictly necessary. Processing personal data also requires a separate GDPR assessment.

03From banner to tags

Common issues a cookie check can reveal

Problems often arise where the consent platform, website and tag configuration meet. Check the first visit as well as what happens after a choice.

Analytics starts too early: GA4 or another analytics tool sets cookies that require consent before the visitor responds. A tag may sit directly in the page template even when GTM is configured correctly.
Rejecting only dismisses the banner: The banner disappears, but marketing cookies or tags continue. Check what “Reject all” actually does in a fresh browser session.
Unequal choices in the banner: A prominent accept button combined with hidden rejection, unclear categories or preselected boxes weakens the visitor's ability to choose freely.
Only Google receives the choice: Google Consent Mode controls the behaviour of Google tags. Meta Pixel, embedded videos and other providers need their own consent configuration or blocking where required.
Settings differ between pages: Landing pages, forms or a new plugin may introduce tracking that does not follow the main site's setup. Check representative pages individually.

04Google Analytics and advertising

What is Google Consent Mode v2?

Consent Mode communicates the user's choices to Google tags. The four main signals have different roles:

analytics_storage: Indicates whether storage for analytics, such as analytics cookies, is allowed.
ad_storage: Indicates whether storage for advertising, such as advertising cookies, is allowed.
ad_user_data: Indicates consent to send user data to Google for advertising purposes.
ad_personalization: Indicates consent to personalised advertising, including remarketing.

Basic consent mode blocks Google tags until consent. Advanced consent mode can load tags with denied signals and send cookieless requests before consent. A request to Google therefore does not automatically mean a cookie was set; the absence of cookies does not mean no information is sent.

A “denied” signal is not legal approval. Your configuration and data processing need to be assessed alongside the banner, purposes and information actually transferred. Google's signals do not automatically cover other tracking providers.

05Use the report

How to follow up your result

Start with the observed findings and give whoever owns your consent setup access to the full report. A practical follow-up can look like this:

Find where tracking originates
Connect cookies and requests to GTM, page templates, plugins or embedded content. Clarify their purposes and whether the technology needs consent.
Fix the consent flow
Update the banner's choices, tag conditions and Google signals. Check that withdrawing consent affects subsequent tracking too.
Test more situations
Run another check after making changes. Also manually test landing pages, mobile devices, fresh browser sessions and relevant regions.
Document and maintain
Record changes and responsibilities. Repeat the check when you change your CMP, tags, plugins or website content.

So you don't have to keep watch

How CitationLab handles GDPR, consent and accurate tracking

Consent is not something you set up once. New campaigns, plugins, landing pages and tags change the setup all the time, and problems are often found only when the numbers stop adding up or someone complains. That is why we treat consent and tracking as operations, not as a project.

Agents that keep watch for you: For clients on an ongoing plan, the agents in CitationLab Manager monitor consent and tracking continuously. If something changes after a release or a new tag, we are alerted and fix it, so you don't have to check yourself.
Compliant and measurable at the same time: The goal is not to switch measurement off but to measure correctly. We connect the consent platform, Google Tag Manager, Consent Mode and server-side tracking so the data you get is both lawful and reliable.
People make the decisions: The agents find and alert. Judgements about purposes, legal basis and what is strictly necessary are made by people with experience in tracking and privacy, together with you and, where needed, your lawyer.
Documented along the way: Changes, findings and who is responsible for what are recorded. That makes it easier to answer a data protection authority, an auditor or a customer who asks how you handle consent.

CitationLab does not give legal advice. We make sure the technical setup does what you have decided, and point out what should be assessed legally.

07Scope

A technical check is not legal approval

The result covers one URL at one point in time. Content behind a login, other pages, regional variations or tags triggered by scrolling and other actions may behave differently. Unknown providers need review; they are not automatically unlawful.

The check does not assess your entire privacy policy, data processing agreements, consent records, legal bases or information forwarded on the server without being visible in the browser. A good result describes what the test observed; it does not certify that all tracking is lawful. Use technical findings alongside an assessment of your own data processing.

Is your website’s tracking legal?

What is a consent check?

When do cookies and tracking need consent?

Common issues a cookie check can reveal

What is Google Consent Mode v2?

How to follow up your result

Find where tracking originates

Fix the consent flow

Test more situations

Document and maintain

How CitationLab handles GDPR, consent and accurate tracking

A technical check is not legal approval

Sources and rules

Questions about consent checks and cookies

Was this page helpful?

Need help fixing the findings?