Checklist
How often should I re-run a cookie consent audit?
Retest cookies before Accept after new pixels, theme or app changes, CMP switches, and seasonal tags. Observation cadence, not a legal mandate.
In brief
Re-run a cookie consent audit when the storefront tracking surface changes. Useful triggers include a new pixel, a theme or app change, a CMP switch, and seasonal campaign tags. A prior Fresh and Reject pack goes stale when the scripts that produced it are no longer live. ConsentProbe can store a new pair. A free US-baseline scan is not an EU or California legal conclusion. This page is an observation cadence, not a statutory re-audit mandate, and not legal advice.
Not legal advice
This FAQ explains an observation cadence for re-running cookie consent audits after storefront changes. It is not legal advice, not a statutory re-audit mandate, not a counsel calendar, and not a GDPR, ePrivacy, CPRA, or other compliance certificate. ConsentProbe reports are technical observations of what fired. They do not say what counsel would allow, and they do not say how often counsel requires a formal review. Observation is not counsel permission.
Last updated September 28, 2026. The testing hub owns which test to run next. The pre-consent checklist owns the pass order. The retest-after-fix guide owns the rerun after a Reject or GPC fix. The CMP-switch guide owns the rerun after a vendor migration. This page does not rewrite those guides. It answers when a prior Fresh and Reject pack goes stale.
Short answer
Re-run a cookie consent audit when the storefront tracking surface changes. Useful triggers include a new marketing pixel or tag, a theme or app change, a CMP switch or a major banner config change, and seasonal campaign tags that only exist for a few weeks. This page does not set a statutory interval.
A prior Fresh and Reject pack goes stale when the scripts, apps, or consent wiring that produced it are no longer the ones live on the storefront. Treat cadence as observation hygiene. Run Fresh and Reject again after the change, keep the evidence pack, and open the hub or the checklist when you need which test is next.
After a Reject or GPC fix, retest the path you fixed. After a CMP migration, retest claims against runtime. The retest-after-fix guide and the CMP-switch guide own those reruns. This page does not paste them.
Triggers that stale a prior pack
A quiet calendar and a changed storefront are different facts. Write the reason as the change you shipped, then rerun Fresh and Reject. Leave any formal review schedule with counsel.
| Trigger | Why Fresh and Reject can go stale | Where to open next |
|---|---|---|
| New marketing pixel, tag, or embed | New hosts and cookies can appear before Accept | Before-Accept audit and the marketing-pixels FAQ |
| Theme, app, or plug-in change | Scripts can inject outside the old gate path | Pre-consent checklist and the Shopify checklist |
| CMP switch or major banner config | New claims are not the prior runtime proof | CMP-switch retest and claims versus runtime |
| Seasonal or campaign tags | Temporary scripts exist only for a window | Testing hub, for which pass is next |
| After a Reject, GPC, or pixel fix | You need proof the fixed path holds | Retest-after-fix guide |
Why a fixed calendar alone is weak
A quiet month with no tag changes may not need a new pack. A loud week with three new pixels does. The trigger is the change, not a date this page invents.
An Accept-only capture, or one old Accept file, does not prove Fresh and Reject still hold after a change. The Reject-if-Accept FAQ covers that split. This page does not paste it.
CMP marketing copy and auto-block claims change with vendor versions. Runtime is the check. The claims-versus-runtime guide and the CMP-switch guide own those comparisons. This page only points at them.
Counsel may set a formal review schedule. This page does not invent that schedule. Ask counsel for mandate questions. Observation is not counsel permission.
Fresh and Reject after a trigger
These steps refresh the pack after a named change. They do not install a CMP, rank vendors, or set a legal calendar. The testing hub and the pre-consent checklist say which pass is next. The retest-after-fix guide and the CMP-switch guide own their own reruns.
- Note the change, whether it is a pixel, a theme or app, a CMP, or a campaign, and write the date.
- Use a clean profile. Load the storefront once. Do not click Accept. Capture Network, cookies, storage, and the banner. Label the pack Fresh.
- Open a new clean profile. Click Reject All. Navigate once. Recapture the same layers. Label the pack Reject.
- Compare the new pair with the last pack for the same URL. Write one finding sentence per new or returned mismatch.
- Keep the evidence pack with the change note.
- If you just fixed Reject or GPC, follow the retest-after-fix guide. If you just switched CMP, follow the CMP-switch guide. For which test is next, open the hub or the checklist.
When the last pack is the only file
Waiting for a calendar reminder while tags keep shipping leaves Fresh and Reject unproven. After a trigger, ConsentProbe runs Fresh and Reject on the storefront URL. Each finding stays tied to a request, a cookie, or a screenshot.
Use the free US-baseline visit when you want the report format. Use paid EU or California scenarios when those regions are the claims. The free versus paid guide draws that line. ConsentProbe does not set a legal audit schedule, does not install a CMP, and does not issue a certificate.
FAQ
How often should I re-run a cookie consent audit?
After a concrete storefront change, such as a new pixel, a theme or app change, a CMP switch, or seasonal tags. This page does not set a statutory interval.
Do I need a new audit after switching CMP?
Yes. Retest claims against runtime. The CMP-switch guide is that rerun.
Is a quiet month with no tag changes a reason to skip?
Often the prior pack still describes the live surface. Retest when something changes, or when counsel asks for a new look.
Does this page set a legal re-audit mandate?
No. This is an observation cadence. Ask counsel for mandate questions. Observation is not counsel permission.
What if I just fixed Reject All?
Retest the fixed path. The retest-after-fix guide is that rerun. Keep the evidence pack.
Is this legal advice?
No. These are technical observations. Observation is not counsel permission. ConsentProbe does not replace counsel, and it does not install a CMP.
Limits of this page
This page tells you which storefront changes stale a prior Fresh and Reject pack, and which published guide to open next. It does not rewrite the testing hub, the pre-consent checklist, the retest-after-fix guide, or the CMP-switch retest. It is not legal advice, not a statutory re-audit mandate, and not a certificate. Observation is not counsel permission. ConsentProbe reports stay tied to requests, cookies, and screenshots. A free US-baseline scan is not an EU or California legal conclusion.
Related guides
Open the testing hub for which test is next, the pre-consent checklist for the pass order, the retest-after-fix guide after a Reject or GPC fix, and the CMP-switch guide after a vendor migration. The before-Accept audit and the evidence-pack page cover the first load and how to file it.
- Cookie audit hub: which consent test should you run first?
- Pre-consent audit checklist: what to verify before Accept
- How do you re-test after a GPC or Reject All fix?
- How to Retest After Switching CMP Vendors
- How to run a cookie audit before Accept
- What belongs in a cookie consent audit evidence pack?
- Reject All Still Tracking: What to Check After You Say No
- What does a free US-baseline cookie audit prove vs paid EU or California scans?
- CMP claims vs runtime evidence: how do you prove the banner actually works?
- Does Reject All stop marketing pixels?
- Do I still need a Reject All test if Accept All looks fine?
- ConsentProbe methodology
- Pricing and listed regional products
Sources
These links cover the platform and regulatory context used in this guide. Applicability still depends on the organization and jurisdiction.
Save a US-baseline technical record
After a DIY check, run a free US-baseline audit: one browser visit outside California, with cookies, requests, and screenshots stored as evidence. That visit does not run EU reject/accept or California GPC. EU, California, and Global 2 audits can be purchased from Billing after sign-in.