Short answer
Use a clean private browser session, open the Network panel before loading the page, and do not interact with the banner. Optional analytics and marketing requests should not start before the visitor gives the relevant consent.
A banner can be visible while trackers already run. The useful test is observable behaviour: requests, cookies, and tag initialization before the first choice, then the difference after Reject, Analytics only, and Accept all.
What to check
- Requests to Google Analytics, Google Tag Manager, Meta, TikTok, LinkedIn, Hotjar, Clarity, and similar services.
- Cookies or storage keys created before a visitor action.
- A GTM or gtag configuration that runs before denied consent defaults.
- Different behaviour on landing pages, blog templates, checkout, and localized routes.
Practical steps
- Open a private window and clear site storage if necessary.
- Open Developer Tools and the Network panel, then load the production URL.
- Before any choice, note optional third-party requests and cookies.
- Choose Reject all, navigate once, and confirm optional tracking remains blocked.
- Choose Analytics only and Accept all in separate clean sessions; compare the released tags.
- Run GDPRChecker to retain a repeatable scan record.
Common mistakes
- Testing in a browser that already has consent stored.
- Looking only at the banner instead of Network and storage behaviour.
- Checking the homepage but not campaign landing pages.
- Calling a cookieless or server-side request harmless without reviewing its purpose and legal basis.
Important boundary
Know the scope
A technical scan identifies observable requests and configuration signals. It does not decide whether a particular processing operation has a lawful basis; obtain legal advice for that assessment.