How to check if your cookie banner actually blocks trackers before consent
A cookie banner that shows up but lets trackers fire anyway is a decoration, not compliance. The rule is simple: nothing that profiles or tracks a visitor may load until they click accept. Most small-business sites fail this test because the banner was installed but the scripts were never held back. Here is how to check yours in about ten minutes, with no developer required.
The banner is not the compliance part
Think of the banner as the front door and script blocking as the lock. The door can look perfect while the lock does nothing. On a typical small-business site, Google Analytics, ad pixels, social widgets, and video embeds are loaded by scripts in the page header. Installing a banner plugin usually adds the pop-up but leaves those scripts exactly where they were, firing on every page load. The visitor sees a consent choice that has no effect on what actually happens in their browser.
This is the single most common failure we see on small sites. The owner did everything right in spirit: they bought a banner, configured the colors, wrote a cookie policy. But they never checked whether trackers waited for consent, so the site has been collecting data before consent for months.
The ten-minute check
You need a Chrome or Edge window and one trick: private or incognito mode, which starts with a clean slate so your own earlier visits do not skew the result. Open a private window, then open your site and do not click anything on the banner.
- Right-click anywhere on the page and choose Inspect. A panel opens.
- Click the Network tab inside that panel, then reload the page (keep the banner unanswered).
- In the filter box of the Network tab, type common tracker names one at a time: google-analytics, googletagmanager, facebook, doubleclick, tiktok, youtube, hotjar.
- Watch what loads. If you see requests to googletagmanager.com, connect.facebook.net, or similar while the banner is still unanswered, those trackers fired before consent.
That is the whole test. A compliant site in this state loads almost nothing third party: the page itself, its images, and your banner's own script. A failing site lights up with analytics and pixel requests before you have touched a single button. Write down which trackers fired. That list is your fix list.
The three failure patterns
When a site fails this check, it is almost always one of three things. First, scripts fire with no gating at all: the analytics code sits in the header exactly as Google handed it to you, and the banner never touches it. Second, the banner offers fake choices: every category is prechecked, or scrolling the page counts as consent, or the reject option is buried two screens deep. Third, the banner gates its own known list but misses tag-along scripts: you approved the analytics tag, but the booking widget you embedded last spring loads its own trackers, and the chat bubble you added loads more.
The third pattern is why one check is not enough to be done forever. Every new widget, plugin, or embed can bring trackers the banner does not know about. A contact form with spam protection, a review carousel, a scheduling tool: each of these can quietly add network requests that fire on page load.
Fixing it, in order of effort
Start with the easy wins. If your banner tool has a script-blocking or tag-management feature, turn it on and move your analytics and pixel scripts into it, so they only load after the matching category is accepted. Most modern banner tools can do this; the feature is just never enabled because the default setup only installs the pop-up. Second, check the banner settings for anything prechecked or anything that treats scrolling as consent, and turn it off. Reject must be as easy as accept, and silence must mean no.
Then handle the tag-alongs. Take your list of pre-consent trackers from the ten-minute check and hunt each one down: which plugin or embed loads it? For each, either route it through the banner's blocking feature, replace it with a consent-safe alternative (a self-hosted analytics tool, a simple HTML contact link instead of a chat widget), or remove it if nobody uses it. Small sites accumulate unused widgets the way junk drawers accumulate batteries. The check gives you a reason to clean them out.
Make it a five-minute habit
Sites drift. A client installs a plugin, a developer adds an embed, a new marketing tool gets tried for a month and forgotten. None of those changes announce themselves to the banner. So repeat the ten-minute check once a month, and any time a new tool goes on the site. It takes five minutes when you know the drill: private window, Inspect, Network tab, reload, look for tracker requests before consent. If the list is empty, you are done. If something new appears, you catch it while it is a small fix instead of a complaint letter.
A banner that actually blocks is worth more than a pretty one. Visitors who click accept are giving you real permission, and you can say so with a straight face. Run the check today; it is the fastest compliance win most small sites have left.