UK online shop cookie-consent & tracking checklist (2026)

1. Before consent (fresh browser, no clicks)

• ☐ Open the homepage in a private window with no prior cookies
• ☐ DevTools > Network: note requests to google-analytics, googletagmanager (collect), facebook, tiktok, pinterest, hotjar, clarity, bing
• ☐ DevTools > Application > Cookies: list non-essential cookies (_ga, _gid, _fbp, _ttp, _hj*, _clck, _uetsid)
• ☐ Anything non-essential firing at this point = fix first (UK PECR reg. 6)

2. Banner design

• ☐ "Reject all" is as easy as "Accept all" (same layer, same prominence)
• ☐ No pre-ticked boxes for analytics or marketing
• ☐ Clear categories and a link to the cookie policy
• ☐ Users can change their choice later (footer link or icon)

3. After "Reject all"

• ☐ Reload: no marketing or analytics cookies are set
• ☐ Google Consent Mode v2: ad_storage, analytics_storage, ad_user_data and ad_personalization are all "denied"
• ☐ Pixels (Meta, TikTok, Pinterest) blocked or in limited mode

4. After "Accept all"

• ☐ Tags fire and GA4 DebugView shows events
• ☐ Purchase event fires once per order (no duplicates on thank-you page refresh)

5. Platform settings

• Shopify: Customer Privacy API / consent app set to region UK; check every app that injects scripts; check Settings > Customer events (custom pixels)
• WooCommerce: the consent plugin blocks scripts by category; GTM container respects consent; check caching plugins don't serve a pre-consent version

6. Data accuracy

• ☐ GA4 purchases vs platform orders over 30 days (expect a gap after consent; >40% suggests broken tagging)
• ☐ Revenue currency is GBP and tax/shipping handling is consistent
• ☐ Ads conversion counts match GA4 within reason

7. Documentation

• ☐ Cookie policy lists the actual cookies found
• ☐ Privacy policy names processors (Google, Meta, etc.)
• ☐ Re-check after every new app, theme change or tag