The Quarterly Consent Audit: Five Checks That Catch a Broken Banner Before a Regulator Does
The banner looked fine. It appeared on first visit, it offered accept and reject, and the consent rate held steady at about 60 percent. Then a routine check of the network requests found an analytics tag firing before any choice was made, a vendor added to the list three weeks earlier with no re-prompt, and a GPC signal from a test browser that nobody had ever answered. None of it showed in the banner. All of it would show in an audit.
Consent breaks in the plumbing, not in the banner. A quarterly audit is the cheapest way to find it. Five checks, done in an afternoon, cover the failures that actually draw complaints. Run them in this order, because the first two are the ones that cost the most when they fail.
Check one: the reject path
Open the site in a fresh browser, click reject, and watch the network. Every request that carries an identifier, a fingerprint, or a tracking parameter is a failure. This is the single most common defect in the fleet, and it is also the easiest to catch, because it shows up in the first ten seconds of testing. Reject has to be as easy as accept, and it has to do the same work: stop the tags, not just close the banner.
Test the reject path on mobile too, and on a slow connection. Banners that load late leave a window where tags fire before the choice exists, and the slow connection makes that window longer. If the tag manager fires before the banner renders, the gate is decorative.
Check two: the tag firing order
List every tag on the site and the consent condition each one claims. Then compare that list with what actually fires on a fresh visit with no choice made. The gap between the two lists is the audit. In most cases the gap is a tag someone added directly to a template, outside the tag manager, months ago. It fires because nobody gated it, and nobody gated it because nobody knew it was there.
Do this with the browser cache cleared and with a hard refresh. A tag that only fires on the second page view is still a tag that fires before consent, just a slower one.
Check three: the GPC signal
Send a Global Privacy Control signal and see what the site does. The signal is a browser setting, and the site has to treat it as an opt-out where the law applies. The EDPB position and the California rules both point the same way: a GPC signal is a valid expression of the visitor's choice, and ignoring it is the same as ignoring a rejection. Record what happened, with a screenshot and a timestamp, because this is the check most sites have never run.
Check four: the vendor list version
Compare the vendor list the banner shows today with the list it showed last quarter. If a vendor was added, was the visitor re-prompted? The list changes more often than people think, and each addition is a new purpose the visitor never agreed to. A CMP that silently updates its list and keeps the old consent is keeping a consent that no longer matches what the visitor saw.
While you are there, check the list version number in the consent record. If the record does not store the version, you cannot prove what the visitor agreed to, and the record is worth less than the paper it is not printed on.
Check five: the record export
Export one consent record and read it as a regulator would. It should show the visitor, the timestamp, the choices, the banner version, and the vendor list version. If any of those fields is missing, the export is a summary, not evidence. Run the export on a record from three months ago, not yesterday, because old records are the ones that break first.
Five checks, one afternoon, once a quarter. The sites that run them find the same three defects every time: a tag that fires early, a vendor list that moved, and a record that cannot prove what it claims. Fix those three and the next quarter gets shorter.
Keep reading: what a tag manager consent audit finds, how to test a consent record export, and how the GPC signal test works cover the nearby cases in this series.
Frequently asked questions
How often should I audit my consent banner?
Once a quarter is the right cadence for most sites. The banner itself rarely changes, but tags get added, vendor lists update, and browser behaviour shifts. A quarterly check catches those changes before they have been live for months. Run the same five checks each time so the results compare.
What is the most common consent defect an audit finds?
A tag firing before any choice is made. It is usually a script added directly to a template, outside the tag manager, so nobody gated it. It shows up in the first ten seconds of a network check on a fresh browser, which is why the reject-path test comes first.
Do I really have to respond to a GPC signal?
Yes, where the law applies. A Global Privacy Control signal is a valid expression of the visitor's choice, and ignoring it is treated the same as ignoring a rejection. Test it with a browser that sends the signal, and record what the site does with a screenshot and a timestamp.
What makes a consent record usable as evidence?
It has to show the visitor, the timestamp, the choices, the banner version, and the vendor list version, all in one place. If any of those fields is missing, the record is a summary, not evidence. Test an old record, not a fresh one, because old records are the ones that break first.