Picture of Seth

Seth

Your Cookie Banner Is Working.

But Is Your Consent Implementation?

A cookie banner appears, visitors can accept or reject cookies, preferences can be selected. Everything looks like it is working.

But that does not necessarily mean consent is actually being enforced correctly behind the scenes.

We recently investigated a consent implementation where the visible experience appeared functional, but deeper testing uncovered several problems between the consent management platform, Google Tag Manager, and the marketing technologies relying on those signals.

The issue was not the banner itself. It was what happened after the visitor made a choice. That distinction matters because modern consent management is not one tool.

It is a chain of systems that have to communicate correctly:

Visitor Choice → CMP → GTM → Consent Signals → Marketing Tags → Cookies & Data Collection

If one of those handoffs fails, the banner can appear perfectly normal while the underlying behavior tells a very different story.

The Challenge:

The Banner Looked Fine

From the visitor’s perspective, the consent experience appeared to work.

  • The banner loaded.
  • Visitors could accept or reject categories.
  • The site remained usable.

That is often where testing stops.

But a visible banner only confirms that the user interface exists.

It does not confirm that:
    • marketing tags are respecting the visitor’s choice
    • third-party cookies are blocked when required
    • Google Consent Mode is receiving the correct signals
    • consent choices persist between pages
    • GTM triggers are correctly mapped to CMP categories
    • previously loaded technologies respond correctly when consent changes

Those behaviors require technical validation. That is where the problems became visible.

Consent Is a System, Not a Banner

A consent management platform, or CMP, is only one piece of the implementation.

A typical setup might involve:

Consent Management Platform
↓
Consent Categories
↓
Google Tag Manager
↓
Google Consent Mode
↓
GA4 / Google Ads
↓
LinkedIn / Meta / Other Marketing Tags
↓
Cookies and Network Requests

Each system has its own role.

  • The CMP records the visitor’s preference.
  • GTM determines which technologies can execute.
  • Consent Mode communicates consent state to supported Google technologies.
  • Third-party platforms may require separate blocking or triggering logic.
If those systems are not configured to work together, the visible preference may not match the actual behavior of the website.

What We Tested:

Instead of relying on the banner interface alone, we tested the implementation from multiple angles.

That included:

  • clearing cookies and browser storage
  • opening the site as a new visitor
  • reviewing GTM activity
  • monitoring browser cookies
  • inspecting network requests
  • accepting consent
  • rejecting consent
  • navigating to additional pages
  • checking whether the selected consent state persisted
  • validating the consent information being passed to Google technologies
This type of testing is important because each layer answers a different question.

The banner answers:
What choice did the visitor make?
The browser answers:
What cookies were actually written?
GTM answers:
Which tags actually executed?
Network activity answers:
Which platforms actually received data?
Consent Mode answers:
What consent state did Google technologies receive?
You need all of those perspectives to understand whether the implementation is working as intended.

Findings:

Finding 1: Tags Can Fire Before Consent

One of the most important things to test is what happens before the visitor interacts with the banner.

A common assumption is:
The banner is visible, so marketing technologies must be waiting.

That assumption is not always correct.

During testing, we observed third-party marketing technologies becoming active before the consent process had been completed.

That creates an important implementation question:

Is the organization intentionally using a consent model that allows limited behavior before consent, or are tags executing because the CMP and GTM configuration are not aligned?


Those are very different scenarios.

The correct answer depends on the organization’s requirements and consent strategy, but the behavior should always be intentional.

Finding 2: Rejecting Consent Is Only Half the Test


Clicking Reject All and watching the banner disappear does not prove rejection is being respected.

The next step is to continue navigating.

  • Does the visitor’s choice persist?
  • Do marketing tags remain blocked?
  • Do the same consent values remain active on the next page?

In one implementation we tested, the visitor rejected optional consent categories and continued browsing the website. After navigation, the underlying consent state no longer reflected the visitor’s previous choice.

The visible action had worked. The state management behind it had not persisted correctly.

That is precisely the kind of issue that can go unnoticed if QA ends after clicking the banner.

Finding 3: CMP Configuration and GTM Configuration Have to Agree


Consent problems are often blamed entirely on the CMP.

But the CMP may be recording the user’s preference correctly while GTM is interpreting or acting on that preference incorrectly. The reverse can also happen.

A reliable implementation requires alignment between:

  • CMP categories
  • GTM triggers
  • Tag-level consent requirements
  • Google Consent Mode states
For example, a marketing category might be represented by one value inside the CMP, while GTM expects a different event or data-layer condition before allowing a tag to fire. Everything can look correct independently.

The failure occurs between the systems.

Finding 4: Google Consent Mode Needs Its Own Validation


Consent Mode adds another layer to the architecture. It is not enough to simply see that Google tags are installed. You need to understand the consent state they are receiving. Depending on the implementation, Google technologies can behave differently based on values related to storage and advertising consent.

That means QA should include validation of the consent information being communicated to Google tags before and after the visitor makes a choice.

The important question is not:
Is Consent Mode installed?
It is:
Is Consent Mode receiving and responding to the correct consent state throughout the visitor journey?

The Goal:

Make User Choice Match Actual Site Behavior

The goal of consent implementation is not simply to display a preference interface. It is to create a reliable connection between what the visitor selects and what the website actually does.

Conceptually:

Visitor Rejects Marketing
↓
CMP Records Rejection
↓
Consent State Persists
↓
GTM Receives Correct State
↓
Marketing Tags Respect That State
↓
Cookies and Requests Behave Accordingly

The same principle applies when consent is granted. The visitor’s choice should propagate reliably through the entire system.

How We Approach Consent QA

A practical consent implementation review should answer several questions.

1. What happens before interaction?

Load the site as a new visitor.

Before clicking anything, inspect:

    • cookies
    • GTM activity
    • network requests
    • consent state
    • third-party tags
This establishes the default behavior.

2. What happens after Accept?

Accept the available consent categories.

Then confirm that:

    • the expected consent values update
    • relevant tags can execute
    • expected cookies can be created
    • the choice persists during navigation
3. What happens after Reject?

Repeat the process after rejecting optional categories.

Then validate that:

    • the consent state changes correctly
    • restricted tags behave as intended
    • optional cookies are not being introduced unexpectedly
    • the rejection persists when the visitor moves to another page

4. What happens after the visitor changes their mind?

Consent should also be tested when preferences are modified later. A visitor may initially accept and then revoke consent. The implementation should have a defined behavior for that scenario as well.

The Outcome:

Consent That Can Be Verified, Not Assumed

The value of this testing is not simply finding a broken trigger. It creates confidence that the complete consent architecture behaves consistently.

Instead of saying:
We have a cookie banner.
the organization can move toward saying:
We have tested how consent moves from the visitor’s choice through our CMP, tag manager, analytics, and marketing technologies.

That is a materially stronger position. It also helps separate three different issues that are frequently confused:

User experience – Does the banner work?

Technical enforcement – Do technologies respond correctly?

Consent persistence – Does the visitor’s choice remain intact throughout the session and across navigation?

All three matter.

Why This Matters Beyond Privacy


Consent configuration also affects data quality. If consent state is inconsistent, the resulting analytics environment may be inconsistent too.

For example:

  • analytics collection may behave differently between pageviews
  • conversion tags may execute unexpectedly
  • advertising platforms may receive incomplete or inconsistent signals
  • reports may become harder to reconcile
  • user behavior can differ depending on when or where consent state is lost
Consent management therefore sits at the intersection of:

privacy + analytics + marketing technology + data quality

That is why it should not be treated as a banner-design exercise.

What We Learned

A visible banner proves very little.


It confirms that the interface loaded. Technical QA is still required to understand what tags, cookies, and requests are actually doing.


Always test before consent.

Some of the most important problems happen before the visitor clicks anything.

Always navigate after Reject.

Consent persistence issues may not appear until the next page loads.

Test the entire chain.

CMP configuration, GTM, Consent Mode, marketing tags, cookies, and network activity should be treated as one connected system.

Define the desired behavior before troubleshooting.

Before changing anything, organizations should decide what they actually want:

    • strict prior blocking
    • Google Consent Mode behavior
    • regional differences
    • required versus optional categories
    • which third-party technologies must be controlled
Without that definition, it is difficult to determine whether observed behavior is a bug or intentional configuration.


Don’t assume the platform configured itself correctly.

CMPs make consent management easier. They do not eliminate the need for implementation design and QA.

Cookie Consent Implementation FAQs

Does a working cookie banner mean my site is respecting consent?
Not necessarily.

A functioning banner confirms that visitors can make a selection. You still need to validate whether tags, cookies, and data collection behavior actually reflect that choice.
There are several possible reasons.

The implementation may intentionally use a consent framework that allows limited behavior, or the CMP, GTM triggers, consent defaults, or individual tags may not be configured correctly.

The correct diagnosis requires inspecting the underlying implementation.
Reject optional consent, inspect cookies and tag behavior, then continue navigating the website.
The consent state should continue to reflect the visitor’s choice unless the visitor changes it.
No.

They serve different purposes.

  • A CMP manages the consent experience and visitor choices.
  • Google Consent Mode communicates consent state to supported Google technologies and changes how those technologies behave.
They often work together as part of the same implementation.
Yes.

Changes to a website, GTM container, CMP configuration, templates, scripts, or marketing technologies can affect how consent behaves.

Consent should be treated as part of ongoing measurement QA rather than a one-time setup task.

Your Cookie Banner Is Only the Beginning

Consent management is not one interface sitting at the bottom of a website. It is a connected technology system.

The Agency Co-Op helps organizations evaluate how consent actually moves between CMPs, tag management, analytics, and marketing platforms so the behavior of the site matches the choices presented to visitors.

If your consent strategy has only been tested by clicking the banner,
there is more to validate.

Ready to Elevate Your Performance?
Let's Get Started Today!

Contact Us
Scroll to Top