How to Audit a Cookie Banner: Choices, Storage and Requests

A banner review has two parts: what the visitor can choose, and what the website does with that choice. Take a screenshot of the first layer, then test actual cookies and requests. A polished banner can hide an integration error; an unfamiliar cookie name can also belong to the consent tool itself.

Prepare the browser before checking the banner

1. Use a new browser profile or clear site data for the audited site. If using the extension in a private window, ensure it is enabled there.
2. Record the URL, browser version, date, login state and region used in the test. A server-hosted scan may see a different regional banner.
3. Open DevTools Network with Preserve log and the Application storage panel. Load the page without clicking the banner.
4. Save the initial banner screenshot and note any optional purpose selected by default. Record the initial cookies and requests separately.

Review the choices a visitor can actually make

Describe the interface precisely: for example, rejection requires three actions while acceptance requires one. Avoid treating a visual heuristic score as a legal decision. Review the applicable consent guidance and the visitor’s jurisdiction separately from your technical findings.

Run four separate consent tests

1. Before choice: load the page in a clean session. Record new storage and outgoing requests without interacting.
2. Reject: use another clean session, reject optional purposes and reload. Compare subsequent requests with the baseline.
3. Partial acceptance: start clean again and accept only analytics. Check whether advertising remains disabled and whether the banner remembers that selection.
4. Withdraw: accept a service, reopen settings and disable it. Check new requests after withdrawal and after navigation; do not confuse a cookie left over from acceptance with a fresh write.

Turn observations into a useful developer ticket

An illustrative ticket might read: ‘Fresh profile, product page, no banner interaction. A request to the analytics endpoint starts before the choice; initiator is the theme analytics snippet. Expected behavior for this site’s basic consent implementation: the snippet waits.’ This is a reporting template, not a finding about a particular website. Attach your own timestamps and evidence.

Use Google Consent Mode analysis alongside Google’s implementation guide. Advanced mode can send cookieless pings with denied consent. The presence of a request alone does not establish what identifiers it contains or whether the implementation meets all applicable requirements.

Use the right tool for each part of the review

The free online cookie audit gives you a passive browser snapshot. The Chrome extension and Firefox extension let you observe the page while making choices. Dark-pattern checks can highlight interface concerns for manual review. Save a redacted debug snapshot for a developer when an issue is reproducible.

Questions to resolve before signing off

• Did you check a direct page load and an internal route change?
• Were old preferences cleared between independent scenarios?
• Were optional services both disabled and enabled in separate tests?
• Did you verify the published production configuration after clearing relevant caches?
• Does the report explain untested regions, authenticated pages and scan limitations?