You’ve invested in a Consent Management Platform (CMP). The banner shows up, the buttons work, and you assume you’re respecting user privacy and complying with regulations like GDPR and CCPA.
But what if you’re not?
Many CMPs are nothing more than “consent theater.” They provide the appearance of choice without actually preventing tracking tags from firing. This common misconfiguration can lead to hefty fines, eroded customer trust, and hopelessly skewed analytics data.
The good news is you don’t need to be a developer to verify your setup. Here are three simple steps you can perform right now to see if your CMP actually blocks tags when it’s supposed to.
Step 1: The Pre-Consent Check
This first test checks if tags are firing before a user has given any consent at all. This is the most critical and common failure point.
- Open a New Incognito/Private Window: This ensures you’re seeing the site as a new visitor with no existing cookies.
- Open Developer Tools: Right-click anywhere on the page and select “Inspect,” or press
F12(Cmd+Opt+Ion Mac). Go to the Network tab. - Load Your Website: Type in your URL and press Enter. Your CMP banner should appear.
- DO NOT CLICK THE BANNER YET.
- Filter the Network Log: In the “Filter” box of the Network tab, search for common tracking script domains one by one. Good ones to check include:
google-analytics.comgoogletagmanager.comfacebook.com(for the Meta Pixel)linkedin.com(for the LinkedIn Insight Tag)tiktok.com
What to Look For: If you see any requests being sent to these marketing or analytics domains before you have clicked “Accept,” your CMP is not configured correctly. It is failing to block tags prior to consent.
(Example: A request to google-analytics.com firing before the user interacts with the CMP banner is a clear compliance failure.)
Step 2: The “Reject All” Test
Now, let’s see if your site respects a user’s choice to opt out.
- Interact with the CMP: In the same window, click “Reject All,” “Deny,” or the most restrictive option available on your banner.
- Clear the Network Log: Click the “clear” icon (usually a circle with a line through it) in the Network tab to start fresh.
- Navigate Your Site: Click on a few different pages or refresh the current one.
What to Look For: The Network tab should remain free of the marketing and analytics tags you searched for in Step 1. If you see requests to Facebook, Google Analytics, or others after explicitly rejecting consent, your CMP is failing to honor the user’s choice.
Step 3: The “Accept All” Test
Finally, let’s confirm your tags fire correctly when a user does consent. If they don’t, your marketing and analytics teams are losing valuable data from users who have opted in.
- Open a New Incognito Window: Close the previous one to start completely fresh.
- Open Developer Tools & Load Your Site: Go to the Network tab again as you did in Step 1.
- Click “Accept All” on your CMP banner.
- Navigate Your Site: Browse a few pages.
What to Look For: Now, you should see the requests to google-analytics.com, facebook.com, etc., appear in your Network log. This confirms that your consent mechanism is capable of passing the “accept” signal to your tag manager or tags.
From Manual Checks to Automated Governance
Performing these checks gives you a powerful snapshot of your current compliance status. But websites are not static. New marketing tags get added, scripts get updated, and site code changes, creating new opportunities for data leakage.
Manually checking your site every day isn’t scalable or reliable.
This is where automated tag governance becomes essential. Tools like TagPipes integrate directly with your CMP and tag manager to act as a definitive enforcement layer. It continuously monitors and controls every tag on your site, ensuring they only fire according to the user’s real-time consent choices—no exceptions.
Don’t assume your CMP is working. Know it is.
Take Control of Your Customer Data
Worried about what you might find? Let us help. Get a free, no-obligation privacy audit to uncover exactly how your tags are behaving and identify any compliance risks.