Consent QA: test what happens after the banner

The cookie banner opens, the buttons work, and the selected choice is saved. That proves the interface works. It does not yet prove that an analytics tag, advertising tag, or server-side destination follows that choice.

Consent QA checks the path from a person’s selection to the systems receiving data. It belongs in campaign and website release work, especially when a new tag, template, destination, or consent-management platform is introduced.

A consent-management platform, often shortened to CMP, manages choices and communicates them to other components. Each component still needs to interpret the signal correctly.

Agree on expected behavior before testing

Ask the privacy owner and implementation team for the approved behavior in each supported region and choice state. Turn that into a testable description: which requests may occur, what data they may contain, and what storage may be used.

Avoid one universal rule based only on whether a tag “fires.” For example, Google distinguishes basic and advanced consent mode. Basic mode blocks Google tags until the relevant interaction and consent; advanced mode can send limited, cookieless measurements while storage consent is denied. The appropriate implementation depends on the organization’s requirements.

A technical feature does not, by itself, establish that a particular deployment meets those requirements.

Use a test matrix

For each journey, record the browser, region configuration, CMP version, tag version, choice, expected result, and actual result.

State	What to check
First visit, no choice yet	The approved default is set before dependent tags act.
Reject optional purposes	Storage, requests, and payloads match the rejected state.
Accept selected purposes	The implementation does not treat a partial choice as permission for everything.
Change a previous choice	Later events use the updated state.
Return visit	The stored choice is applied without an unintended collection window.
Move to checkout or another domain	The next environment receives or obtains the appropriate choice.

Include both a fresh browser session and a return session. A test account that has already accepted everything can conceal the very problem you are trying to find.

Follow one conversion all the way through

Imagine a visitor accepts analytics but declines advertising purposes, then completes a test purchase. The analytics report receives the event as expected. A separate advertising destination also receives a full payload because a custom tag ignored the purpose-specific choice.

The banner has behaved correctly; the implementation has not met the approved rules.

Inspect the web request, any server-side processing, and the destination diagnostics. Google’s server-side consent guidance describes how consent signals travel from the browser to its server container. Do not assume unrelated custom tags or destinations inherit the same behavior automatically.

Use test identifiers. Retain only the evidence needed to reproduce the issue and restrict access to logs that contain sensitive fields.

Check timing as well as values

A correct consent value arriving too late can still produce an incorrect first event. Compare the timing of the default state, user update, page event, and conversion event.

Test slower connections and page transitions. A fast local test may miss a race between the CMP and a tag loaded elsewhere on the page. Also check tags installed outside the main tag manager; removing a trigger from one container will not remove a hard-coded script.

For Google implementations, Tag Assistant’s consent checks can help verify defaults, updates, and tag behavior. Combine that view with the actual request evidence needed for your destinations.

Give a failed check an owner

Write a defect around the observed behavior: “After advertising consent is declined, destination X receives field Y on the purchase event.” Include the expected behavior and a reproducible sequence.

After the fix, repeat the affected journey and the neighboring states. A change that fixes rejection can accidentally break partial acceptance or a return visit.

Keep the approved matrix with the campaign launch checklist. Reuse it when tags or consent components change, and update it when the organization changes its requirements.