Cookie consent checker
Detects whether a real cookie consent mechanism is present and wired up.
What TMOD checks
- Scans the crawled pages for known consent management platforms, matched against their identifying scripts and markup.
- Falls back to an AI reviewer read of the page when the heuristic is inconclusive, so a hand-rolled banner is still recognised.
- Looks for a cookie policy page alongside the banner, since consent without an explanation of what is being consented to is incomplete.
- Reports which platform was detected when one is found, so you can confirm it is the one you think you installed.
Why it matters
If you have EU visitors and you run analytics or ads, consent is a legal requirement, not a design preference. Non-essential cookies need informed, affirmative consent before they are set, and enforcement in this area has become considerably more active.
The common implementation failure is subtle and near-universal: the banner is installed but the tags are not gated behind it. Scripts load on page view, cookies are set, and the banner appears afterwards asking permission for something that already happened. That satisfies nobody and is arguably worse than no banner, because it documents that you knew consent was required.
AdSense adds its own requirement on top. Publishers serving EU traffic must use a Google-certified consent management platform, and running a homemade banner will not satisfy it regardless of how legally sound your own implementation is.
How to fix it
01Use a certified platform for EU traffic
If AdSense is the goal, this is not optional, Google requires a certified CMP for EU and UK traffic. Several established platforms have free tiers that cover a normal content site.
02Gate the scripts, not just the display
Consent must block tracking until it is given. In practice this means wiring the CMP to your tag manager or consent mode so tags fire on the consent signal. Installing the banner and leaving the tags in the head is the failure mode this check exists to catch.
03Make refusing as easy as accepting
A prominent Accept next to a buried Manage preferences link is a dark pattern and regulators have said so explicitly. Reject All should be as reachable as Accept All, in the same place, at the same visual weight.
04Write the cookie policy the banner points at
List the cookies actually set, their purpose, who sets them and how long they last. The banner asks for consent; this page, alongside the privacy policy, is what makes that consent informed.
What a compliant banner looks like
Consent has to be given before anything non-essential runs, freely, specifically and unambiguously. In practice that rules out several things people still ship: pre-ticked boxes, a banner that treats continued scrolling as agreement, a design where Accept is a button and Reject is a link three clicks away, and a wall that makes the site unusable until someone agrees to tracking.
It also has to be reversible. Someone who agreed in January needs a way to change their mind in March, which means a persistent link somewhere ordinary rather than a banner that never returns. Withdrawing consent should be as easy as giving it, and the tags should stop when it is withdrawn rather than continuing until the cookie expires.
Granularity is the part homemade banners usually miss. Analytics, personalisation and advertising are separate purposes, and someone can reasonably accept one and refuse another. If you are serving ads through Google, the certified platform requirement is doing this work for you, which is a good reason to use one even where you would rather not.
The cost nobody budgets for
A consent platform is the one third-party script you cannot defer, because everything it gates has to wait for it. It loads early, it blocks, and on a slow connection the banner arrives visibly after the text does. That makes it the heaviest script on many otherwise light sites, and it is worth measuring against the load time rather than assuming it is free.
The layout cost is just as real. A banner injected after render shifts everything below it, which is exactly what the layout shift metric penalises, and on a phone the combination of a sticky header, the banner and a floating button can leave almost no readable area. Reserving the space the banner will occupy, rather than letting it push the page down, fixes most of that.
Then there is the data. Once tracking is properly gated, analytics stops recording the visitors who declined, so the numbers drop on the day it is implemented and that drop is not a bug. Wiring the consent signal through to your tag setup, rather than simply blocking the scripts, is what keeps the modelling and the reporting coherent afterwards. The policy audit checks the mechanism rather than the appearance for this reason: a banner that changed nothing about what fires has cost you performance and bought you nothing.
Questions
Do I need a cookie banner if I only use analytics?
Analytics cookies are non-essential under GDPR, so for EU visitors yes. Some analytics tools offer a cookieless configuration that avoids the requirement entirely, which is worth considering if a banner is the only thing forcing you into consent management.
My banner is detected but the check still warns.
Detection confirms a banner exists, not that it works. The reviewer also looks at whether tracking appears to be gated behind it. A banner that displays while tags have already fired is detected and still flagged, correctly, the presence of the banner is not the compliance requirement, the gating is.
Does this apply to visitors outside the EU?
GDPR follows EU residents wherever they are, so a global site generally has EU visitors and is in scope. Other regimes differ, CCPA is opt-out rather than opt-in, for instance. Most operators run one consent mechanism sized to the strictest regime they touch rather than trying to branch by geography.