Cookie consent banners: what an audit can verify

Cookie consent is the banner, and the mechanism behind it, that asks visitors whether a site may set non-essential cookies and only loads the tags that use them once they agree.

In the EU, a site has to get consent before storing cookies that are not strictly necessary, and informing the visitor is not enough on its own. The European Commission’s web guide gives examples: third-party advertising cookies and social plug-in trackers generally need consent, while cookies that remember what a user typed into a form generally do not. Google’s consent mode is the technical side for its own tags. Consent types such as ad_storage, analytics_storage, ad_user_data and ad_personalization tell Google tags what the visitor allowed. This page describes what squirrelscan detects. It is not legal advice.

Category: Legal Compliance

Why it matters

A banner is the easy part. The part that matters is the gating: non-essential cookies set before the visitor answers, or after they decline, defeat the purpose whatever the banner says. Consent mode adds a further step for sites that use Google’s tags: the visitor’s answer has to reach the tags as consent states, including ad_user_data and ad_personalization, which govern sending user data to Google for advertising and personalised ads.

How squirrelscan checks it

legal/cookie-consent looks for a consent mechanism on each page, skipping soft 404s and sites classified as personal sites or portfolios: a script from one of about twenty consent platforms, such as Cookiebot, OneTrust or Usercentrics, a known banner container, or a cookie dialog with an accept or reject control. It warns when none is found on a site whose audience the audit places under the GDPR, and reports at info level otherwise. analytics/consent-mode runs on pages with Google tags. It passes when the HTML carries consent mode with the v2 signals, notes consent mode without them, and notes when there is none. Consent mode configured only inside a tag manager container is not visible in the HTML.

Neither rule can tell whether tags actually wait for consent. That needs a browser and a person clicking the banner.

How to fix it

Install a consent platform, or build one that holds every non-essential tag until the visitor answers. For Google tags, set defaults before any tag loads:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied', analytics_storage: 'denied',
    ad_user_data: 'denied', ad_personalization: 'denied'
  });
</script>

Then call gtag('consent', 'update', …) with the visitor’s answer (the consent mode fix). Do not pre-tick optional categories, make rejecting as easy as accepting, and store the answer (the consent fix).

Run the check

squirrel audit https://example.com --rule-include legal/cookie-consent,analytics/consent-mode

A signed-out local audit costs nothing.

Related terms

• Cookie attributes: The Secure, HttpOnly and SameSite flags on Set-Cookie that limit where a cookie is sent and whether scripts can read it.
• Privacy policy: The page explaining what personal data a site collects and why; required by law in many places and a trust signal for search.

References

• Cookies and similar technologies, European Commission web guide
• Consent mode overview, Google Tag Platform
• Data protection and online privacy, Your Europe