Privacy & Compliance
Your Cookie Banner Probably Isn’t Doing Anything. Here’s How to Check in 10 Minutes.
There is a specific kind of false comfort that comes from installing a cookie banner. The notice appears, visitors click accept, and the matter feels closed. Nobody revisits it, because visibly something is there.
The trouble is that a large share of banners on the web are decoration. They display a notice and record a click, but they never actually prevent anything from loading. Google Analytics, the Meta pixel, a chat widget, an embedded video player — all of it fires the moment the page opens, before the visitor has agreed to anything at all. The banner is paperwork laid over unchanged behavior.
You do not need to take anyone’s word for whether this describes your site. You can check it yourself, right now, with tools already built into your browser. Here is how.
Before you start: use a clean window
Open a private or incognito window. This matters more than it sounds. If you have visited your own site before, your consent choice is probably already stored, and the site will behave as though you accepted everything. A clean window makes your browser look like a genuine first-time visitor, which is the only state where this test means anything.
Test one: what loads before anyone clicks anything
In your private window, open developer tools before you load the site. In Chrome, Edge or Firefox that is F12, or Cmd+Option+I on a Mac. Go to the Network tab and make sure recording is on.
Now load your homepage — and do not touch the banner. Leave it sitting there. In the Network tab’s filter box, type a domain you would expect to see only after consent. Good candidates:
google-analytics.comorgoogletagmanager.comfacebook.netorfacebook.comdoubleclick.nethotjar,clarity.ms,fullstoryor any session recording tool you uselinkedin.com,tiktok.com,bing.comif you advertise on those
If requests to those domains appear while the banner is still on screen untouched, your banner is not gating anything. That is the whole test. It is genuinely that simple, and it is where most sites fail.
Test two: what cookies got set anyway
Still without touching the banner, switch to the Application tab in Chrome or Edge (Storage in Firefox) and look at Cookies for your domain.
A first-time visitor who has consented to nothing should see very little: a session cookie, perhaps a cookie recording that the banner was displayed, and not much else. If you find _ga, _gid, _fbp, _gcl_au or a scattering of third-party entries you cannot account for, they were set before consent existed.
Worth noting: cookies are only part of the picture now. Plenty of tracking happens through network requests that carry an identifier without ever setting a cookie. An empty cookie jar is not proof of a clean page, which is why test one comes first.
Test three: does reject actually reject?
This is where setups fall apart most often, and it is the test almost nobody runs.
Open a fresh private window, load the site, and this time click reject — or decline, or whatever the negative option is called. Then clear the Network tab, browse to two or three other pages, and watch what goes out.
The answer should be nothing from the list above. What we frequently see instead is a banner that faithfully stores a rejection, displays a tidy confirmation, and then continues loading exactly the same scripts it loaded before. The visitor was told their preference was saved. It was saved. It just was not applied to anything.
Test four: is rejecting as easy as accepting?
This one needs no developer tools, just an honest look at your own banner.
Count the clicks. If accepting takes one click and declining takes three — open preferences, toggle four categories off, save — that asymmetry is exactly what European regulators have spent years objecting to. A big colored Accept next to a grey line of text that says “manage settings” is a pattern that has drawn repeated enforcement attention, and it is trivially visible to anyone evaluating your site.
Test five: can you prove any of this later?
If someone asked you to demonstrate that a particular visitor consented to marketing cookies on a particular date, could you produce anything?
Most consent platforms log this. Many installations never have it switched on. Consent you cannot evidence is difficult to distinguish from consent you never collected, and that distinction only matters at the exact moment you would least like it to.
What to do if you failed
Most sites fail at least one of these. Some fail all five. It is usually not negligence — it is that consent plugins ship with blocking switched off by default, because switching it on without categorizing your scripts first tends to break things. The setup step gets skipped, the banner appears, and everyone reasonably assumes the job is finished.
Fixing it means inventorying every script your site loads, sorting each into a category, wiring the blocking so nothing runs before its category is approved, and then verifying the result rather than assuming it. That last part is the step that distinguishes a banner from a compliance posture.
We’re not attorneys and this isn’t legal advice. We handle the technical side: making sure what’s on your site does what you think it does.
Find out what your site is actually loading
We’ll run the audit and show you what fires before anyone clicks accept — every cookie set, every third-party script, every request going out, with screenshots and in plain English.
