The notice, the panel and the default
Three things decide what a visitor's consent means: what the notice offers, where the controls are, and what is on before anyone clicks. We read all three on the live site, then test them.
On one national retailer's site the notice carried one line of text, one privacy policy link and one close button. No accept, no reject, no manage control. Five QA runs on five pages, identical. The notice blocked navigation until closed, so every visitor closed it without being asked anything. The consent platform was set to an opt-out model with all five categories active before any interaction.
The control did exist. It sat on a preference page three clicks away, below a newsletter form, and opened with every toggle already on. Saving it with three toggles off wrote a refusal the platform recognized. Our first published finding said no control existed anywhere. It was wrong, and we corrected it on the record the same night. The severity of the default did not change. The sentence did.
What a cookie compliance audit measures
Per consent state, on real devices, with the network recorded:
- Which cookies are set, by which host, in which category the platform assigns them. Five categories configured on the retailer's site, four of them carrying cookies; the fifth carried none.
- Which calls go out. A cookie is one signal. A request to an ad server is another, and it can carry an identifier without setting a cookie at all.
- Whether the gates hold. With Targeting refused, the gated marketing tags on the retailer's site obeyed: zero Google conversion or remarketing calls, zero from the gated retargeting tag, the social and the session-replay vendors silent.
- What sits outside the gates. Same page, same refusal: 30 calls to a retail-media network and 2 to its delivery endpoint, 10 ad safeframe containers, 3 ad requests, one cookie-matching call and one cookie-sync script. The consent platform's Targeting toggle did not touch any of it. Whether that is compliant depends on how the company classifies its own retail-media advertising. The audit reports what fired. The decision is the company's.
- Analytics under refusal. The analytics requests went out marked as denied and reached the vendor as cookieless pings, seven on one page. It means the history is not what a "consented users only" filter assumes.
GDPR cookie audit and the AI that reads the result
Cookie consent compliance is usually treated as a legal question. It is also a data question. If the consent field is a constant because the default was on and the control was hidden, then every row in the history carries the same consent value, and an AI asked "how did consented users convert" answers from a field that never varied. It cannot know. The cookie audit is how it gets known.
What you receive
| Deliverable | What it holds |
|---|---|
| Consent-state matrix | Each state your notice allows, and what loaded in it. |
| Cookie table | Name, host, lifetime, category as assigned, category as observed. |
| Call table | Every request per state, decoded, with the consent string it carried. |
| Gate report | Which tags obeyed the refusal, which fired outside any gate. |
| Notice review | What the visitor saw, where the control was, what was on by default. |
| Fix list | For the container owner and the consent platform owner. |
No legal opinion. We are engineers. Where a finding needs counsel, the report says so.
Consent mode and the data layer
Google's consent mode is one of the gates we test; how it signals denial and what still flows is on /consent-mode-v2. The variable that carries consent into the tag container usually lives in the data layer; what that means for the audit is on /data-layer. The site-wide measurement is the tracking audit; the one case we can show is on /cases.