Is Your Cookie Banner Actually Working? Four Ways to Find Out

No. A banner is the visible part of consent, not the mechanism. Compliance depends on whether tracking scripts are actually blocked until someone agrees, whether the decision gets recorded, and whether that decision reaches your vendors. A banner that displays a message while analytics runs underneath is worse than no banner, because it documents that you asked and then ignored the answer.

Open your site in an incognito window, open developer tools, and watch the network tab without touching the banner. Filter for your analytics or ad script. If it appears before you click anything, it fired without consent. Then click reject and check again. If the same script is still running, the banner is decoration.

They generate the interface, not the enforcement behind it. Tools like Cursor, Bolt and Lovable produce a component that looks correct and stores a flag once dismissed. Script blocking, jurisdiction detection, consent logging and vendor signalling all sit outside what gets generated, and those are the parts regulators care about.

A banner collects an answer. A consent management platform enforces it and keeps the evidence. That means blocking scripts before consent, recording each decision with a timestamp and jurisdiction, passing signals to advertising vendors, and producing records if a regulator asks. Storing a cookie that marks the banner as seen gives you none of that.

Yes, and this catches people who assume compliance and performance are separate problems. Google needs consent signals to attribute conversions from European traffic, delivered through Consent Mode. A banner that doesn't send them leaves Google assuming no consent was given, so conversions vanish from your reporting while the campaigns themselves are working fine.

Yes, if you have visitors from the EU or UK. Analytics cookies aren't exempt under ePrivacy rules, which is the common misreading. The exemption covers strictly necessary cookies only, such as session handling and load balancing. Analytics measures behaviour for your benefit rather than to deliver the service, so consent applies.

Yes. Under GDPR you have to be able to demonstrate that consent was given, which means keeping a record of who consented, when, to what, and under which version of your banner. Verbal assurance that a banner was live doesn't satisfy this. The requirement is proof you can produce on request.

Replacing a decorative banner with a working consent platform typically takes under an hour on most sites. The install adds a script to your site, scans it to identify what's actually being set, and blocks those scripts by category until consent arrives. The scan usually turns up trackers nobody knew were there.