Cookie consent banners

Why consent banners (OneTrust, Cookiebot) matter for beacon audits: tags should fire after consent, and the audit shows what actually loads.

What consent banners do

Consent management platforms (CMPs) like OneTrust and Cookiebot show the cookie banner, record the visitor's choices, and gate tracking scripts so marketing and analytics tags only fire after the visitor consents (in regions where the law requires it). They're the enforcement layer between "we have a privacy policy" and "trackers actually wait for permission."

Why they matter for beacon audits

A beacon report and a consent banner answer two halves of the same question:

• The beacon table shows which trackers are embedded on each page.
• The consent setup determines which of them are allowed to fire for a given visitor.

The critical failure mode is trackers firing before consent: a pixel hardcoded in the page template loads on every visit regardless of the banner. The audit detects the presence of OneTrust, Cookiebot, and similar CMPs, and the beacon inventory shows everything embedded — comparing the two is the starting point of a real consent review.

What the audit can and can't verify

• Can: detect the CMP's presence and version signals; list every tracker embedded per page; show load method (direct script vs. tag manager).
• Can't: click "accept" or "reject" and observe what changes — that requires interactive browser testing, which is outside an automated audit's scope. The static scan also can't tell you whether a tag manager is configured to respect consent state; it can only show the container is present.

Browser-render mode gets you closer: it executes the page as a first-time visitor (no consent given), so trackers that fire in that state are firing pre-consent — a concrete, reportable finding.

Typical findings

• No CMP at all — marketing pixels firing on a site subject to consent requirements.
• CMP present, tags hardcoded outside it — the banner exists but key pixels bypass it.
• Legacy pixels outside governance — old tags installed before the CMP, never migrated into its rules.