SiteVerdictA compliant cookie banner does three things you can test yourself: nothing non-essential loads before the visitor chooses, "Reject" is as easy as "Accept", and after "Reject" no advertising or tracking tags fire. You can check all three in about ten minutes with the free developer tools built into Chrome, Edge or Firefox. These are the same three points the UK Information Commissioner's Office (ICO) tested on the UK's top 1,000 websites.
What "compliant" means in practice
In the UK, PECR regulation 6 requires consent before you store or read information on a visitor's device, unless an exception applies. Since 5 February 2026 there are exceptions for strictly necessary storage, some first-party-style analytics and preference cookies, as long as you tell people and let them object. Advertising, retargeting and audience tags always need consent. In the EU, analytics usually needs consent too.
The ICO's December 2025 update on the top 1,000 UK websites listed what it checked:
- Whether non-essential advertising cookies were stored before visitors could accept or reject them.
- Whether rejecting those cookies was as easy as accepting them.
- Whether non-essential advertising cookies were placed without consent.
The test below covers each point, plus the design checks that make consent valid.
Before you start
- Use a desktop browser: Chrome, Edge or Firefox. The steps below use Chrome's names; the others are similar.
- Open a private or incognito window so you start with no cookies and no saved consent choice.
- Turn off ad blockers and privacy extensions in that window, or they will hide the very requests you are looking for.
- Have a note open to record what you see. Screenshots help if you need to brief a developer.
The 10-minute test
Step 1: Open DevTools before the page loads (1 minute)
- In the private window, press
F12(orCtrl+Shift+I, orCmd+Option+Ion a Mac) to open DevTools. - Click the Network tab. Tick Preserve log so requests stay listed when pages change.
- Now type your website address and press Enter. Do not click the banner.
Step 2: Check cookies before consent (2 minutes)
- Click the Application tab (in Firefox, Storage).
- Under Storage, expand Cookies and click each domain listed.
- Write down every cookie name. Also look in Local storage.
Cookies you would usually expect to see before consent are things like a session ID, a load-balancer cookie, a security token, or the consent tool's own cookie that stores the visitor's choice. Cookies that usually signal a problem if they appear before consent:
| Cookie name (examples) | Usually set by | Purpose |
|---|---|---|
_fbp | Meta Pixel | Advertising |
_gcl_au, _gcl_aw | Google Ads conversion tracking | Advertising |
_ga, _ga_<ID> | Google Analytics 4 | Analytics. In the UK this may fall under the statistical exception only if every condition is met; in the EU it usually needs consent |
_clck, _clsk | Microsoft Clarity | Analytics and session recording |
_ttp | TikTok Pixel | Advertising |
IDE, test_cookie (on doubleclick.net) | Google advertising | Advertising |
Names change over time and vary by setup, so use this as a guide, not a definitive list. Your consent tool or the provider's documentation will list the exact cookies.
Step 3: Check network requests before consent (2 minutes)
Go back to the Network tab. Type each of these into the filter box in turn and look for matching requests:
| Filter text | What it finds |
|---|---|
collect | Google Analytics 4 hits (to a URL containing /g/collect) and some other analytics tools |
googletagmanager | Google Tag Manager and the Google tag (gtag.js) loading |
doubleclick or googleads | Google advertising requests |
facebook | The Meta Pixel loading from connect.facebook.net and sending events to facebook.com/tr |
clarity | Microsoft Clarity loading from clarity.ms |
tiktok, linkedin, pinterest, hotjar | Other common pixels and recording tools |
A script loading is not always a problem. Some setups load the tag first and hold it in a "denied" state until consent. What matters is whether it sets cookies or sends tracking data. Click a request and look at its URL and payload. Google Analytics hits usually carry a parameter called gcs that shows the consent state the tag believes it has. Google does not document it in detail, but it is widely read as G1 plus two digits for ad storage and analytics storage: G100 means both are denied and G111 means both are granted. If you see G111 before anyone clicked Accept, the tag is wrongly treating consent as given.
Step 4: Look at the banner itself (1 minute)
- Is there a "Reject all" (or "Decline") option on the first layer? It should be as easy to find and click as "Accept all": similar size, similar placement, similar wording style.
- Are any optional categories pre-ticked under "Settings" or "Manage preferences"? They should start off. The EU Court of Justice ruled in Planet49 (C-673/17) that a pre-ticked box is not valid consent, and UK GDPR requires a clear positive action.
- Does it explain what you use and why, in plain words, with a link to more detail?
- Can visitors use the site if they ignore the banner? A banner that blocks the whole page until you click Accept, with no way to refuse, is a "cookie wall". The ICO's view is that a "take it or leave it" cookie wall does not meet the requirement for consent to be freely given in most cases.
- Is it accessible? Can you reach and press every button with the keyboard alone (Tab and Enter)? Is the text readable at normal zoom?
Step 5: Click "Reject all" and re-check (2 minutes)
- In the Network tab, click the clear icon to empty the list. Keep Preserve log on.
- Click Reject all on the banner.
- Click to another page on your site, then reload it.
- Repeat the cookie check (Step 2) and the request check (Step 3).
After Reject, you should see no new advertising cookies and no advertising requests. Cookies set before you clicked do not disappear by themselves. A good consent tool deletes them, or at least stops tags from reading them. If _fbp or _gcl_au is still being set or refreshed, or facebook.com/tr requests are still going out, the rejection is not being respected.
Step 6: Clear everything, click "Accept all" and confirm tags work (1 minute)
Close the private window, open a new one and visit again. This time click Accept all. Your analytics and advertising tags should now load and set cookies. This step matters: a broken setup sometimes blocks tags for everyone, which looks compliant but loses you all your data. Then check that a "Cookie settings" link (often in the footer) lets you change your mind and that withdrawing consent works as well as Reject did.
Step 7: Repeat on a phone-sized screen (1 minute)
In DevTools, click the device toolbar icon (or press Ctrl+Shift+M) and choose a phone size. Banners that look fine on desktop often hide "Reject" below the fold or behind a scroll on mobile.
Google Consent Mode v2 explained
Consent Mode is Google's way for its tags (Google Analytics, Google Ads, Floodlight) to read the choice your banner records and change how they behave. It does not show a banner or collect consent. Google's documentation says: "You are responsible for obtaining users' consent on your website or app."
Version 2 uses four consent types:
| Consent type | What it controls |
|---|---|
ad_storage | Storage, such as cookies, related to advertising |
analytics_storage | Storage related to analytics, such as visit duration |
ad_user_data | Whether user data can be sent to Google for online advertising |
ad_personalization | Whether data can be used for personalised advertising, such as remarketing |
There are two ways to run it:
- Basic consent mode. Google tags do not load until the visitor interacts with the banner. If they do not consent, Google says no data is sent to Google at all. This is the simpler choice from a privacy point of view.
- Advanced consent mode. Google tags load when the page opens, with consent defaulting to denied. While denied, the tags send what Google calls measurements without cookies ("cookieless pings"). Full data is sent after consent.
If you use advanced mode, you will see Google requests in Step 3 even before consent. Check that they carry a denied consent state and that no Google cookies are set. Whether cookieless pings themselves fall under PECR depends on what is read from the device. The ICO guidance covers technologies beyond cookies, so assess this rather than assume it is fine.
Google's EU user consent policy applies to visitors in the EEA, the UK and Switzerland. It requires you to get legally valid consent for cookies where the law requires it, and for personalised advertising. Microsoft Clarity similarly says it does not place cookies for visitors from the EEA, the UK or Switzerland unless it receives a valid consent signal, and it supports Google's Consent Mode signals as one way to send it.
Common failures and how to fix them
| What you see | Likely cause | Fix |
|---|---|---|
| Meta or Google Ads cookies before any click | Pixel pasted into the theme header, or added in Tag Manager without a consent trigger | Remove the hard-coded copy; fire the tag only on a consent event, or use the consent tool's script blocking |
| Tags still fire after Reject | Two copies of a tag, one controlled and one not; or a plugin that adds its own tracking | Search your theme, plugins and Tag Manager for duplicates; disable plugin tracking features you do not use |
| No Reject button on the first layer | Consent tool on default or "implied consent" settings | Turn on a first-layer Reject all button with equal styling |
| Optional categories ticked by default | Tool configuration | Set all optional categories to off by default |
gcs=G111 before consent | Consent Mode default set to granted, or default command firing after the tags | Set defaults to denied and make sure the default runs before any Google tag |
| Nothing fires even after Accept | Consent update never reaches the tags | Check the consent tool's Tag Manager integration and the order of scripts |
| YouTube or map embed sets cookies on load | Standard embed code | Load embeds after consent, show a click-to-load placeholder, or use a privacy-enhanced embed where offered |
| Banner covers "Reject" on mobile | Layout not tested on small screens | Test at phone width; keep both buttons visible without scrolling |
How SiteVerdict automates this check
Doing the test above by hand is useful once. Doing it after every plugin update is tedious. SiteVerdict's consent check loads your page the way a new visitor would and records which cookies are set and which tracking requests go out before any choice is made. Where it can find the banner's Reject control, it repeats the check after Reject. It reports tags it recognises firing too early, such as Google Analytics, Google Ads, the Meta Pixel and Microsoft Clarity, and the Consent Mode signals Google tags report.
- The SiteVerdict Chrome extension runs the check on any page you have open, including your own site after a change.
- The SiteVerdict WordPress plugin checks your site from the dashboard, where most consent problems on WordPress start: themes and plugins that add their own tags.
- The SiteVerdict API lets agencies and developers run the same check across many sites.
An automated check is a technical test, not a legal opinion. It cannot see tags that only fire after a login or a specific action, and it cannot judge whether your wording is clear. Use it to catch the mechanical failures, then review the rest yourself.