Having a cookie banner and having a cookie banner that works are two different things. Plenty of UK online shops show a perfectly good-looking banner while analytics and ad tags load in the background regardless of what the shopper clicks.
You can find out which kind you have in about ten minutes. All you need is Chrome (or Edge, Brave or any Chromium browser) and the built-in DevTools. Work through the three tests below in order.
Before you start (1 minute)
- Close every private/incognito window, then open a fresh one. Each test needs a clean slate.
- Open DevTools: F12 on Windows, Cmd+Option+I on Mac.
- Go to the Network tab and tick Preserve log, so requests don't disappear when the page reloads.
- Paste this into the Network filter box. It's a regular expression that catches the most common trackers:
/google-analytics|googletagmanager|doubleclick|facebook|tiktok|pinterest|hotjar|clarity|bing|snapchat/
Keep a note open to jot down what you find. A simple table of test, what loaded and which cookies were set is enough.
Test 1: Before any choice (3 minutes)
Load your homepage and don't touch the banner. Wait a few seconds for everything to load.
What to look at in Network
Not every match is a problem. Loading the Google Tag Manager script (gtm.js) is just a file download. What matters is tracking hits:
/g/collecton google-analytics.com or your own domain: GA4 sending datafacebook.com/tr: Meta Pixel eventsanalytics.tiktok.com,ct.pinterest.com,bat.bing.com: other ad platforms- Hotjar or Clarity requests: session recording and heatmaps
If you see Google hits, click one and look for the gcs parameter. gcs=G100 means Consent Mode is telling Google that both ads and analytics are denied. That's what you'd expect if your store uses Consent Mode's "advanced" setup, which sends cookieless pings. Any other value before a choice is a red flag.
What to look at in Application › Cookies
Click your domain and scan the list. Common non-essential cookies include _ga and _ga_* (GA4), _gid, _fbp (Meta), _ttp (TikTok), _hj* (Hotjar), _clck (Clarity), _uetsid (Microsoft Ads) and _pin_unauth (Pinterest).
Test 2: Reject all (3 minutes)
In the same window, click Reject all. First, notice how easy that was:
- Was "Reject all" on the first layer, as visible as "Accept all"?
- Or did you have to click "Manage settings" and untick boxes?
- Were any analytics or marketing boxes pre-ticked?
The ICO's guidance expects rejecting to be as easy as accepting. A bold "Accept" button next to a faint "settings" link is a common problem.
Now reload the page, then visit a product page and add something to your basket. Check Network and Cookies again. After "Reject all" there should be:
- no
facebook.com/tr, TikTok, Pinterest or Bing hits - no new
_ga,_fbpor similar cookies - Google hits, if any, still showing
gcs=G100
"Add to basket" is a good extra test because many stores fire extra marketing events there, sometimes from a different app than the one that fires page views.
Not sure what your store fires before consent?
Send us your URL and we'll run a free homepage pre-consent scan: which trackers and cookies load before a shopper chooses. No obligation.
Get my free scan Use the free checklistTest 3: Accept all (2 minutes)
Close the private window, open a fresh one, load your homepage and click Accept all. Now you're checking the opposite: that tracking you're entitled to actually works.
- Google hits should now show
gcs=G111(both granted). - The
_gacookie and, if you use Meta,_fbpshould appear. - Meta
PageViewrequests should appear in the Network tab.
If nothing fires even after accepting, your banner may not be sending its consent update. That breaks your analytics without making you any more compliant. Our Consent Mode v2 explainer explains the default-then-update sequence that should happen here.
Finally, open a new tab in the same private window and load your site again. The banner shouldn't reappear, and tracking should carry on straight away. That proves returning visitors' choices are being applied.
Bonus checks if you have 5 more minutes
- Entry pages: repeat Test 1 on a product page and a blog post, opened directly. Some themes load extra scripts on particular templates.
- Change your mind: find the footer link or icon to change cookie settings. Is there one? Does withdrawing consent stop tracking on the next page?
- Cookie policy: does it list the cookies you just found? Out-of-date policies are very common.
- Tag Assistant: connect
tagassistant.google.comto your site for a clearer view of Google consent states, including the two v2 signals thegcsparameter doesn't show.
What your results mean
| What you found | Likely cause | Where to look |
|---|---|---|
| Meta, TikTok or similar fire before a choice | Hard-coded pixel, app injecting scripts, or a GTM tag without a consent check | Theme code, app embeds or plugins, GTM consent settings |
GA4 sets _ga before a choice | Consent Mode default missing, set to granted, or set too late | CMP settings, GTM Consent Initialization trigger |
| "Reject all" has no effect | Banner shown but not connected to tags | CMP script blocking, Shopify Customer Privacy API, WP Consent API |
| Nothing fires after "Accept all" | Consent update not sent | CMP's Google Consent Mode setting |
| Banner reappears every page | Consent cookie not saved, often caching | Cache and optimisation plugin settings |
For platform-specific fixes, see our Shopify Meta Pixel guide and WooCommerce consent setup guide.
Make it routine
Ten minutes is short enough to repeat after every new app, plugin, theme update or tag. Those are exactly the moments a working setup tends to break. Download our free cookie-consent and tracking checklist to keep the steps to hand. It also covers the data-accuracy side: whether GA4's purchase numbers line up with your real orders.
Want it checked properly?
The TrackCheck Health Check is a fixed-price review for UK Shopify and WooCommerce stores: a full consent test (before choice, after "Reject all", after "Accept all", including Consent Mode v2 signals), a GA4-vs-orders reconciliation, a prioritised fix list and a recorded walkthrough, delivered in 5 working days.
See Health Check pricing Start with a free scanThis article is technical guidance, not legal advice. Platform menus change; check the vendor's current documentation if a setting has moved.