Cookie consent banner present
Why this matters
A consent banner that fires before tags is the practical prerequisite for Consent Mode. Its absence usually means tags load before any choice is made.
How this tool detects it
The tool looks for the signature of known consent management platforms, covering OneTrust (including cdn.cookielaw.org and OptanonWrapper), Cookiebot, CookieConsent, Iubenda, Termly, Didomi, Usercentrics and Klaro.
It checks both brand-name strings and runtime variables, because some deployments load only a minified script where the original brand string never appears.
This check is read together with the Consent Mode rule. Finding consent signals with no CMP signature usually means the signals are hard-coded — which is a compliance risk, because you cannot demonstrate that they reflect a real user choice.
Where this check can mislead you
Static analysis has limits. These are the cases where this particular check will report a result that does not match reality — worth knowing before you act on it.
- Identifying the platform is not verifying it works. The tool detects the CMP by script signature and cannot confirm the banner actually appears or genuinely blocks tags.
- The CMP category mapping is not checked. A CMP that exists but never binds advertising tags to consent signals is functionally absent.
- Legal compliance of the CMP cannot be assessed. Consent requirements differ by jurisdiction, and that calls for legal judgement rather than a technical check.
- Minified scripts may contain no recognisable strings. Some deployments are aggressively minified and signature detection misses them.
Examples
<script src="https://cdn.cookielaw.org/scripttemplates/otBannerSdk.js"
type="text/javascript" charset="UTF-8"></script>
<script async src="https://www.googletagmanager.com/gtm.js?id=GTM-ABC123"></script>The CMP has to load first so it can intercept and set consent state before any tag fires.
<script async src="https://www.googletagmanager.com/gtm.js?id=GTM-ABC"></script>
<!-- CMP queued after GTM — too late to matter -->
<script src="https://cdn.cookielaw.org/scripttemplates/otBannerSdk.js"></script>GTM loads and fires tags early in the page lifecycle. When the CMP is queued behind it, data has already left before the visitor makes a choice.
How to fix it
- If you have no CMP, add one. Mainstream platforms (OneTrust, Cookiebot) handle the IAB TCF 2.3 framework requirements for you, which is far easier than hand-rolling.
- Make sure the CMP loads before every tracking tag. Get the order wrong and the consent state never takes effect in time.
- Configure the CMP's category mapping so advertising tags are bound to the right consent signals.
- Verify by clicking accept and then reject, and confirm the consent parameters in GA4 DebugView change accordingly.
- Check that the CMP genuinely blocks tags when consent is refused, rather than only reading the user's choice.
Verify it worked
After making changes, confirm delivery rather than assuming. These steps require your Google login, which is exactly why this tool stops short of them.
- Open the site and confirm the consent banner appears before tags load — compare the request timing of the CMP script against the tag scripts in the Network panel.
- Click accept and refuse in turn, filter the Network panel for
/g/collect, and confirm the request behaviour matches expectations. - In GTM Preview, confirm each tag has its consent settings bound to the right signals.
- Confirm the CMP is configured for the IAB TCF 2.3 framework, if you advertise into the EEA.
Related checks
Check whether your site has this problem — no login required.