Consent simulation: the banner gets operated, twice

The deep scan opens the page in a browser, clicks "accept" once and "reject" once, and compares requests and cookies. This line says whether that worked.

What we check

The deep scan loads the page in a headless Chromium with a real browser identifier and waits up to four seconds for the banner. Then it clicks "Accept all", through the known selectors of the detected CMP or through the visible button text, and records every request, cookie and consent call. Second run. Same page, this time "Reject" on the first layer. If there is no reject button there, the state without interaction counts as the reject capture, and a separate finding notes that.

This line reports only the outcome of the procedure: "ok" with the vendor name when both runs completed; otherwise a note with the reason. No banner found. Banner detected but not operable. Page did not load. Time limit reached. Browser currently unavailable. Since September 2026 it is a status row and does not count toward the score.

Why it matters

The static scan reads intent: what is in the source. The simulation reads behaviour: what the browser actually does after a click. The most common real defect in consent setups, marketing requests after "reject", is invisible in the source. The tag manager loads, the CMP asks, and whether a trigger respects the decision is visible only in the network log. Without the simulation, seven findings are missing: reject respected, consent activates measurement, consent update, the Consent Mode default observed in the browser, the basic-or-advanced mode, the tracking architecture and the page_view double count.

Common causes

The CMP renders the banner in an iframe or shadow root the scanner cannot reach (some Sourcepoint and custom builds).
The buttons carry neither known selectors nor unambiguous labels; custom UIs without standard labels stay inoperable.
A bot protection (such as a Cloudflare challenge) stops the headless browser before the banner appears.
The page loads slower than the scan's time budget and the simulation aborts in a controlled way.
There is no reject button on the first layer. The simulation still runs; the reject run is then the state without a click.

The fix

For "not possible", first check whether an interactive CMP runs at all; the cookie banner / CMP finding says which one was detected. If one runs, standard labels on the first layer help, "Accept all" and "Reject all", readable not just by the scan but by screen readers and users. Loosening a bot protection for the scan is not worth it. Check it yourself instead: open the network tab, reject the banner, filter for collect and gcs=. Whatever shows up there after "reject" is the finding the simulation would have delivered.

Matching template

CMP and GTM Consent QA Template

The repeatable test plan for default-denied, consent update and reject, across all four signals.

Get the QA template →

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

We have a banner. Why does the line say "not possible"?

The browser cannot find the buttons. Either the banner sits in an iframe or shadow root, or the buttons carry neither the vendor's selectors nor a readable label such as "Accept all". The third case: a bot protection stops the browser before the banner appears. The static-scan findings then stay in place, the browser findings are dropped.

Does the line count toward the score?

No, since September 2026. It is a status row: it records whether the simulation ran and carries no rating. What the browser sees along the way is rated in the findings reject respected, consent activates measurement and consent update.

What does the scan do to my site in the process?

Two page loads with a real Chrome profile, one click on the banner button each, nothing else. No forms, no order, no subpages; a filter blocks requests to private networks. After 28 seconds at the latest the simulation stops in a controlled way.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint