The 5-Minute Cookie Consent Audit: Is Your Banner Actually Working?
A step-by-step guide to testing whether your cookie banner blocks trackers or just looks good. Works for any consent tool and any website.
Your banner might be lying to you
Cookie banners are easy to add and easy to fake by accident. Most consent tools work when properly configured. But AI builders, quick copy-paste implementations, and multi-plugin setups often create a banner that appears functional but doesn't actually control anything. This 5-minute test tells you which one you have.
Step 1: Open incognito + DevTools
Open a new incognito/private window. Open DevTools (F12 or Cmd+Option+I). Go to the Network tab. Check 'Preserve log' so requests survive page reloads. Clear anything already there.
Step 2: Load without clicking
Navigate to your page. Do NOT interact with the consent banner. Watch the Network tab fill with requests. Filter or scan for: google-analytics.com, googletagmanager.com, facebook.com/tr, connect.facebook.net, hotjar.com, clarity.ms, linkedin.com/px, tiktok.com/pixel, or any other analytics host you use.
Step 3: Read the verdict
If any of these hosts appeared before you clicked 'Accept' — your banner is cosmetic. Trackers are firing without consent. The banner is theater.
If no tracking hosts appeared — your consent setup is working. Skip to step 5 for the reject test.
Step 4: The reject test
Click 'Reject' or 'Necessary only' on your consent banner. Clear the Network log. Reload the page. If any analytics or marketing trackers still appear — your reject path is also broken. The user explicitly said no, and tracking continued.
Step 5: Fix it
If using GTM, implement Consent Mode v2 — it loads in restricted mode without cookies until consent.
If using a CMP (CookieYes, Cookiebot, Termly), check that analytics scripts are blocked by default. Enable 'block before consent' if available.
If using direct script tags in <head>, move them behind a consent check. TrustDebt's AI Fix Prompt generates the exact code for your framework.
After deploying, re-run the 5-minute test. Trackers should only appear after Accept.