The consent chain you can actually observe
For a typical website using a CMP, Google Tag Manager and analytics or advertising tags, inspect five layers: the visible interface, the CMP’s observable state, the Google consent defaults and updates, tag behavior, and outgoing browser requests. These layers can disagree. A button may respond visually while the intended consent update never reaches the affected tag.
Step 1: Document the intended choice
Record the banner and preference categories presented to a first-time visitor. Establish what each category should do under the agreed configuration, including whether the selected jurisdiction changes the available choices. Avoid equating the presence of a CMP with proof that the consent collection process is legally sufficient.
Step 2: Check initialization and timing
Google’s guidance distinguishes initial consent defaults from updates after interaction. In Tag Assistant, locate the earliest Consent event and check the expected parameters such as ad_storage, analytics_storage, ad_user_data and ad_personalization. Then repeat after Accept or Reject. Consent initialization and tag firing order matter: a correct final state cannot retrospectively undo an earlier request.
Step 3: Inspect the behavior of tags and requests
Record which GTM triggers run, which analytics or advertising calls appear, and what cookies or storage entries are present before and after interaction. Differentiate library loading from event collection where possible. A blocked script, a denied-state ping and an ordinary conversion event are different observations and should not be conflated.
Step 4: Test preferences and withdrawal separately
A footer link that reopens the settings interface is useful, but it does not alone prove consent withdrawal works. If the test scope includes withdrawal, save a change from granted to denied, then verify the resulting CMP state and relevant tag and network behavior. Also review what happens after reload. Some downstream effects require separate system-level investigation.
Step 5: Report evidence rather than a blanket pass
State which browser, location, time, consent action and URL were tested; summarize relevant state transitions and requests; then clearly mark untested conditions. The objective is a defensible technical finding under specified circumstances, not a certification covering every downstream vendor. Google’s Tag Assistant troubleshooting guide provides the core consent-event checks.
What about TCF signals?
If the site actually uses the IAB Transparency & Consent Framework, the TC string and CMP interface can form part of this investigation. TCF v2.4 updates are relevant to participating CMPs and integrations, not an obligation for all websites. Browser-visible evidence is also not proof that every receiving vendor lawfully processes the transmitted data.
TECHNICAL IMPLEMENTATION SUPPORT
Need a second look at a CMP and Google tracking integration?
PlainPrivacy investigates consent-state transitions, tag behavior, browser requests and configuration issues, with findings limited to the conditions actually tested.
Request Technical AssistanceTechnical investigation only, not legal advice or compliance certification.