Complianz Migration Checklist: What to Verify After Switching CMPs

Introduction

*Updated for 2026 compliance practices.*

Switching your Consent Management Platform (CMP) is a significant step toward better privacy compliance, but the work doesn’t end once the new banner goes live. A **Complianz migration checklist: what to verify after switching cmps** helps you confirm that consent signals, tag management, and disclosures all align with GDPR and ePrivacy requirements. Without methodical verification, you risk leaving behind consent gaps—tags firing before consent, broken reject flows, or outdated policy links—that can undermine your compliance posture and attract regulatory scrutiny.

This guide provides a practical, step-by-step verification framework for website owners who have migrated to Complianz or any other CMP. We’ll cover what to check in your consent defaults, tag manager configuration, cookie banner behavior, privacy policy, and data subject access request (DSAR) readiness. You’ll also learn how to use GDPRChecker’s scanner to automate validation and catch issues that manual testing often misses.

**Important**: This article offers technical implementation guidance, not legal advice. Always consult a qualified privacy professional for jurisdiction-specific requirements.

What Is a Complianz Migration Checklist?

A **Complianz migration checklist: what to verify after switching cmps** is a structured set of verification steps that website operators follow after replacing one CMP with another—in this case, Complianz. The checklist ensures that the new CMP correctly:

• Blocks or allows tags based on user consent choices
• Respects consent signals across subdomains and embedded content
• Displays accurate cookie descriptions and categories
• Integrates with Google Consent Mode v2 and other frameworks
• Links to an up-to-date privacy and cookie policy
• Provides a functioning mechanism for users to withdraw consent

Because CMPs differ in how they categorize cookies, fire tags, and store consent records, a migration can easily introduce misconfigurations. For example, a tag that was correctly blocked by the old CMP might now fire on page load because the new CMP’s default consent state is different or because the trigger logic wasn’t updated. A checklist closes these gaps systematically.

Why Verification After Switching CMPs Matters

Even a well-planned migration can leave subtle compliance gaps. Consider these real-world scenarios:

• **Example 1: Pre-consent analytics requests.** After switching to Complianz, a site owner notices that Google Analytics requests still appear in the network tab before any consent is given. The cause? The CMP’s default consent for analytics was set to “granted” instead of “denied,” or the Google tag wasn’t correctly integrated with Consent Mode.
• **Example 2: Broken reject button.** A user clicks “Reject All” on the new banner, but marketing cookies are still set. Investigation reveals that the reject action only hides the banner without updating the consent state for third-party scripts.
• **Example 3: Outdated cookie list.** The new banner lists cookies that no longer exist on the site, while several new tracking pixels are missing from the declaration. This mismatch can be flagged during a regulatory audit.

These issues are common because CMP migrations often involve changes to tag management systems, consent APIs, and policy documents. A verification checklist helps you catch them before they become compliance liabilities.

Comparison: Manual Verification vs. Automated Scanning

| Aspect | Manual Verification | Automated Scanning (GDPRChecker) | |--------|---------------------|-----------------------------------| | **Coverage** | Limited to what you can see in dev tools and banner interactions | Crawls multiple pages, detects hidden trackers, and checks consent states at scale | | **Speed** | Time-consuming; requires checking each page and consent scenario | Scans entire site in minutes | | **Accuracy** | Prone to human error, especially with dynamic tags | Consistent, rule-based detection of pre-consent requests and missing disclosures | | **Documentation** | Manual screenshots and notes | Generates timestamped reports suitable for accountability records | | **Best for** | Initial spot-checking and understanding user flow | Ongoing monitoring and pre-launch validation |

We recommend combining both: use manual checks for banner UX and policy reviews, and rely on GDPRChecker’s scanner for comprehensive, evidence-led verification.

Step-by-Step Implementation: Your Complianz Migration Checklist

Below we break down the verification process into five critical areas. For each, we explain what to check, how to test it, and common pitfalls to avoid.

1. Close the Consent Mode Gap

Google Consent Mode v2 allows tags to adjust their behavior based on the user’s consent state. After migrating to Complianz, you must confirm that:

• The default consent state for all relevant consent types (ad_storage, analytics_storage, etc.) is set to “denied” before user interaction.
• Consent states update correctly when the user grants or denies consent via the banner.
• Google tags (GA4, Google Ads, Floodlight) respect the consent signals and do not fire measurement pings until consent is granted.

**How to verify:** 1. Open your browser’s developer tools and clear all site data. 2. Navigate to your site and check the Network tab for requests to `google-analytics.com`, `googletagmanager.com`, or `doubleclick.net` before interacting with the banner. No such requests should appear. 3. In the Console, type `google_tag_data.ics` to inspect the default consent entries. All should show `denied`. 4. Accept all cookies and verify that the consent entries update to `granted` and that analytics requests start flowing. 5. Repeat with partial consent (e.g., accept analytics but deny marketing) and confirm that only the corresponding tags fire.

**Common mistake:** Forgetting to update the Google tag’s consent initialization. In Complianz, you must enable Consent Mode under Wizard > Consent > Services and ensure the Google site tag or Tag Manager container is loaded with the correct consent defaults. Refer to Google’s Consent Mode documentation for technical details.

2. Close the Google CMP Gap

If you use Google AdSense, Ad Manager, or AdMob, Google requires that you use a CMP that integrates with the IAB Europe’s Transparency & Consent Framework (TCF) or Google’s own consent requirements. After migration, verify that:

• Your Complianz configuration includes the TCF integration if you serve ads to EEA/UK users.
• The CMP correctly signals consent to Google’s ad systems.
• No ad requests are sent before consent is obtained.

**How to verify:** - Use GDPRChecker’s Google Consent Mode v2 checker to scan for pre-consent ad requests and consent signal integrity. - Manually check the Network tab for calls to `pagead2.googlesyndication.com` before consent. - Review the Complianz TCF settings under Wizard > Consent > TCF.

**Common mistake:** Enabling TCF but not configuring the correct vendor list or purposes, leading to incomplete consent strings.

3. Close the Cookie Banner Gap

The cookie banner is the most visible part of your CMP. After migration, test every interaction:

• **Implicit consent:** Does the banner block scripts until the user makes a choice? On first visit, no non-essential cookies should be set.
• **Accept all:** When the user clicks “Accept,” are all consented categories of cookies set correctly?
• **Reject all:** Does the “Reject” button actually prevent non-essential cookies? Many CMPs only hide the banner without changing consent states.
• **Granular choices:** If you offer a “Cookie Settings” panel, test toggling individual categories on and off. Verify that only the selected categories’ cookies are set.
• **Withdrawal:** After giving consent, can the user easily reopen the banner and change their preferences? The banner should reappear via a floating button or link.
• **Cross-device/subdomain:** If your site spans subdomains, ensure consent choices are synchronized.

**How to verify:** - Use an incognito/private window for each test to avoid cached consent. - After each action, check the browser’s cookie storage (Application > Cookies) to confirm which cookies are present. - Use GDPRChecker’s scanner to automate banner behavior checks across multiple pages.

**Common mistake:** The “Reject” button is often non-functional because the CMP’s JavaScript only dismisses the banner. In Complianz, ensure that the “Respect Do Not Track” and “Enable cookie blocker” settings are active, and test with a script that sets a third-party cookie.

4. Close the Privacy Policy Gap

Your privacy policy must accurately reflect the data processing activities that occur after the CMP migration. Key checks include:

• **Cookie list:** Does the policy list all cookies and trackers that the new CMP manages? Remove any that are no longer used and add new ones.
• **CMP identification:** The policy should name Complianz as your CMP and explain how users can manage their preferences.
• **Legal basis:** Confirm that the policy states the correct legal basis for each cookie category (consent for marketing/analytics, legitimate interest where applicable).
• **Third-party disclosures:** If the new CMP shares data with additional third parties (e.g., a consent logging service), update the policy accordingly.

**How to verify:** - Use GDPRChecker’s scanner to detect discrepancies between declared cookies and actual cookies found on your site. - Manually compare your cookie declaration (often generated by Complianz) with the cookies you see in browser storage. - Review the privacy policy requirements guide for a comprehensive checklist.

**Common mistake:** Relying solely on the CMP’s auto-generated cookie list without verifying it against reality. Some plugins may not detect all cookies, especially those set by embedded third-party content.

5. Close the DSAR Gap

Data Subject Access Requests (DSARs) require you to provide individuals with a copy of their personal data. After a CMP migration, ensure that:

• Consent records from the old CMP are preserved and accessible.
• The new CMP logs consent with sufficient detail (timestamp, consent choices, banner version).
• You can retrieve and export consent logs for a specific user if needed.

**How to verify:** - In Complianz, check the consent log under Dashboard > Consent. - Export a sample log and verify it includes all required fields. - If you migrated from another CMP, ensure you have exported and securely stored historical consent records.

**Common mistake:** Assuming the new CMP automatically imports old consent logs. Most CMPs do not; you must manually export and archive them before decommissioning the old system.

How to Validate Your Migration with GDPRChecker

Manual testing is essential, but it’s impossible to catch every issue across all pages and user scenarios. GDPRChecker’s scanner automates the verification of your **Complianz migration checklist: what to verify after switching cmps** by:

• Crawling your entire site to detect pre-consent network requests
• Checking that the cookie banner appears and behaves correctly
• Comparing declared cookies against those actually set
• Verifying Consent Mode default and update signals
• Generating a timestamped compliance report you can use for accountability

**To get started:** 1. Sign up for a GDPRChecker account. 2. Enter your website URL and configure the scan (you can target specific pages or the entire domain). 3. Run the scan and review the findings, which are categorized by severity. 4. Address any high-priority gaps, then rescan to confirm fixes.

Regular scanning is recommended, especially after any plugin updates, tag changes, or policy revisions. For more on maintaining ongoing compliance, see our GDPR checklist for small businesses.

Implementation Checklist

Use this numbered checklist to systematically verify your Complianz migration. Check off each item as you complete it.

1. **Confirm default consent state:** Verify that all Consent Mode defaults are set to “denied” before user interaction.
2. **Test pre-consent network requests:** Use browser dev tools and GDPRChecker to ensure no analytics or ad requests fire before consent.
3. **Validate Accept All flow:** Accept all cookies and confirm that all consented categories’ cookies are set.
4. **Validate Reject All flow:** Reject all cookies and verify that only essential cookies are present.
5. **Test granular consent:** Use the cookie settings panel to toggle categories and check that cookies are set/blocked accordingly.
6. **Check consent withdrawal:** After giving consent, withdraw it and confirm that non-essential cookies are removed or blocked.
7. **Review cookie declaration:** Compare the CMP’s cookie list against actual browser cookies; update your privacy policy as needed.
8. **Verify TCF integration (if applicable):** Ensure the CMP correctly signals consent to Google ad systems.
9. **Inspect consent logs:** Confirm that Complianz is logging consent with timestamps and details, and that historical logs are archived.
10. **Update privacy policy:** Add Complianz as your CMP, revise the cookie list, and check legal basis statements.
11. **Test cross-subdomain consistency:** If you use multiple subdomains, ensure consent choices carry over.
12. **Run a GDPRChecker scan:** Perform a full site scan to catch any remaining gaps and generate a compliance report.

FAQ

What is Complianz migration checklist: what to verify after switching cmps? It’s a structured set of verification steps to ensure your new Complianz CMP correctly manages consent, blocks tags before consent, and aligns with your privacy disclosures. The checklist covers consent defaults, banner behavior, tag triggers, policy updates, and DSAR readiness.

Do I need Complianz migration checklist: what to verify after switching cmps for GDPR? Yes. Under GDPR, you must be able to demonstrate that consent is freely given, specific, informed, and unambiguous. A migration can disrupt consent mechanisms, so verifying the new CMP’s configuration is essential to maintain compliance and accountability.

How do I implement Complianz migration checklist: what to verify after switching cmps? Follow a step-by-step approach: test consent defaults, pre-consent requests, banner interactions, policy disclosures, and consent logs. Use browser dev tools for manual checks and an automated scanner like GDPRChecker for comprehensive validation.

How can I verify Complianz migration checklist: what to verify after switching cmps with a scanner? GDPRChecker crawls your site to detect pre-consent network requests, banner behavior, cookie discrepancies, and Consent Mode signals. It provides a detailed report highlighting gaps so you can fix them quickly.

What are common Complianz migration checklist: what to verify after switching cmps mistakes? Common mistakes include: forgetting to set Consent Mode defaults to “denied,” having a non-functional reject button, outdated cookie lists in the privacy policy, and failing to preserve historical consent logs from the old CMP.

Which cookies and trackers should I check for Complianz migration checklist: what to verify after switching cmps? Check all non-essential cookies and trackers, including analytics (GA4), advertising (Google Ads, Facebook Pixel), and functional third-party embeds. Verify they are blocked before consent and fired only after appropriate consent is given.

How often should I review Complianz migration checklist: what to verify after switching cmps? Review the checklist immediately after migration, then whenever you update your CMP, add new tags, change your privacy policy, or at least quarterly. Regular scans with GDPRChecker help catch drift over time.

What evidence should I keep for Complianz migration checklist: what to verify after switching cmps? Keep consent logs from both old and new CMPs, screenshots of banner behavior, records of cookie scans, and dated compliance reports. This documentation demonstrates accountability to regulators under GDPR’s Article 5(2).

Conclusion

Migrating to Complianz—or any CMP—is more than a technical swap; it’s an opportunity to strengthen your privacy posture. By following this **Complianz migration checklist: what to verify after switching cmps**, you can close consent gaps, ensure accurate disclosures, and build a defensible compliance record. Remember that verification is not a one-time event. Regular scans with GDPRChecker, combined with periodic manual reviews, will help you stay ahead of regulatory expectations and user trust.

For further reading, explore our guides on what is GDPR, what is ePrivacy, and what is cookie consent to deepen your understanding of the legal landscape.

Practical examples

Example 1: A small ecommerce site

A shop changes its cookie banner wording before a seasonal campaign. The operator records the previous and new banner version, tests Reject all and Accept all, and stores screenshots plus the resulting network checks. That creates a clear before-and-after record without relying on memory.

Example 2: A B2B lead-generation site

A marketing team adds a form analytics tag through its tag manager. Before publishing, it documents the consent category, the tag trigger, the privacy notice update, and a test showing that the request does not fire after a visitor rejects optional cookies.

Example 3: A multi-page content site

An editor notices that a new embedded video adds a third-party request. The team scans the affected pages, compares the result with the last scan, updates the cookie disclosure if necessary, and keeps the scan report with the deployment reference.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Complianz Migration Checklist: What to Verify After Switching CMPs", "description": "Practical Complianz migration checklist: verify consent defaults, tag triggers, pre-consent requests, and policy disclosures after switching CMPs. Use GDPRChecker to scan and close compliance gaps.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/complianz-migration-checklist-what-to-verify-after-switching-cmps" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice