Cookie banner check: which CMP runs, and does it run before the tags

The check recognises eleven common consent platforms by their SDK, not by the visible banner. No CMP while cookie tags load is critical.

What we check

In the HTML: does the page load the SDK of a known consent platform? The scan knows eleven: OneTrust, Cookiebot, Usercentrics (v2 and v3), Didomi, Borlabs, Klaro, consentmanager, TrustArc, Iubenda, Complianz and CookieYes. It matches script URLs and JS markers, never prose; the words "cookie banner" in a footer do not count. A match means "ok" with the vendor name. No match is critical as soon as cookie tags sit in the source, and a note ("not applicable") when only cookieless tools were detected.

In the deep scan: the consent simulation operates the banner with the detected vendor's selectors, and for unknown banners through the visible button text. For Borlabs the scan also reads the configuration file and shows which tags load only after consent.

What the scan cannot see: a home-built banner with no platform behind it, a CMP loaded late through the tag manager, and vendors outside the list. All three end up as "no consent layer" in the result. Rightly so, most of the time.

Why it matters

The banner is the visible half of consent. The invisible half is blocking: no tag may run before someone has agreed, and since the VG Hannover ruling that includes the tag manager itself. Without a CMP there is neither, and without a consent log there is no proof when it is disputed.

Which platform fits which setup is covered in the comparison of OneTrust, Usercentrics and Cookiebot.

Common causes

There simply is no CMP, and the tracking has run without a consent layer for years.
The CMP only loads on the homepage. Campaign landing pages or a separate shop run without a banner.
A home-built banner without a CMP backend: visible yes, but with no audit trail and no tag-blocking behind it.
After a relaunch the CMP script no longer loads from an old template. Nobody notices, because the banner cookie still sits in their own browser.
The CMP is loaded through the tag manager and thereby loses exactly the window in which it should block tags.

The fix

Integrate a CMP that supports tag-blocking and put the SDK directly into the HTML before every tracking snippet, not into the tag manager. Then rerun the scan: the pre-consent scripts line has to be empty, and in the deep scan no marketing request may leave after "reject". For Usercentrics setups: how the chain continues into the server container is covered in Usercentrics + Server-Side GTM; we run the platform as a certified partner.

Matching template

Consent Mode Audit Checklist

Seven layers, each with a check, a failure signal and an owner. Covers this finding and the six around it.

Get the checklist →

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

We have a banner, but the check says "no consent layer". Why?

The scan recognises a CMP by the SDK call in the page source, not by the visible banner. Three cases trigger the finding: a home-built banner with no CMP behind it, a CMP that only the tag manager loads, and a vendor that is not on the list. In the first case the finding is justified; in the other two the deep scan tries to operate the banner, and the consent simulation finding shows the result.

We track cookieless with Plausible. Do we still need a CMP?

Not for the scan: if it only finds cookieless tools and no cookie tags, the line reads "not applicable" as a note. The analytics tool alone does not decide whether your setup works without consent; every script that stores or reads data on the device does. The pre-consent cookies finding shows what the first request sets.

Is a CMP without tag-blocking enough?

No. A banner that only asks while the tags have long since fired documents a consent that never took effect. The scan sees this in two places: pre-consent scripts in the source, and in the deep scan the requests after "reject". Both have to be empty, otherwise the CMP is decoration.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint