Your consent management platform has a dashboard, and the dashboard says everything is fine: consent rates, banner impressions, a reassuring green tint. Here is what that dashboard actually measures: the banner's own performance. Whether the choices it collects control anything is a different question, answered in a different place, and the vendors have no incentive to point you there.
The place is your browser's network tab, the test takes fifteen minutes, and anyone who can open developer tools can run it. No tooling, no budget, no permission needed.
The test, step by step
- Open a private/incognito window (this guarantees a fresh, consentless state) and open developer tools with the Network tab selected. Check "Preserve log."
- Load your site. Before touching the banner, look: what already fired? Note requests to domains like google-analytics.com, googletagmanager.com, connect.facebook.net, tiktok, doubleclick, and anything else recognizably marketing.
- Decline everything. Use the reject path a real visitor would find. Now browse: a few pages, a product, add to cart if you sell. Watch the network log the whole time, filtering for the domains above (searching "collect" catches GA4).
- Note what fires after declining. This list is the finding. Some entries may be legitimate (a Consent-Mode-limited ping with denied flags, an actually-essential tool); most of what appears here on a failing site is ordinary tracking that never heard about your banner.
- Fresh incognito window, repeat with accept-all, same pages. This is your baseline of what the site does with full consent.
- Compare the two logs. The difference is what your banner actually controls. If the logs look substantially the same, your banner is furniture: it collects choices and controls nothing.
For Google tags specifically, one level deeper: requests carrying gcs or gcd parameters encode the consent state Google received. Denied-state pings after refusal mean Consent Mode advanced mode is at work, which is a configuration you should have chosen deliberately, not discovered (the modes explained).
The four failure patterns you will find
Pattern one: everything fires before the banner is touched. The tags load on page-load, consent tooling arrives too late, and the choice was never in the loop. This is the classic, and it is anatomized here.
Pattern two: decline changes nothing. The banner records the refusal (its dashboard will proudly confirm this) while the tag container, configured by someone else in some other quarter, never subscribed to the signal.
Pattern three: partial wiring. GA4 respects the refusal, the Meta pixel does not, because consent was wired tool by tool and the list has drifted. Every new tag added since the banner project is a suspect.
Pattern four: the subtle inverse. Everything blocks correctly, but marketing quietly wonders why the numbers dropped, nobody connects it to the banner deploy date, and a quarter of budget decisions get made against an unexplained data cliff. Compliant and confused is better than violating and confident, but the grown-up state is knowing.
Make it a habit, not an event
The test's value decays fast, because containers change: new tags, new campaigns, new plugins, a banner tool update. The realistic cadence is the same as all tracking verification: after any release touching tags or consent tooling, and quarterly regardless, fifteen minutes on the calendar of one named person.
Also test the forgotten surfaces while you are there: the mobile viewport (some banners render differently), your highest-traffic landing pages that bypass the homepage, and any subdomain with its own container. Consent failures love the pages nobody demos.
When the test fails
Findings from this test are fixable in days, not quarters: wiring the consent signal into the tag container, gating tags by category, retesting both states. If your own team runs the tags, hand them the two network logs; the diff is the spec. If nobody owns the container, or the logs raise more questions than they answer (mystery domains, tags nobody remembers installing), that is the moment for an outside audit: the same fifteen-minute test, extended to every tag, both consent states, with each finding documented and prioritized. Either way, run the test before believing anyone's assurance, mine included. The network tab has no marketing department, and that is precisely what makes it the one report on your site worth full trust.