Checklist

How to run a cookie audit before Accept

A cookie audit before Accept records cookies, storage, and network requests on a clean first load, then compares isolated reject, accept, and GPC sessions.

Published September 13, 2026Updated September 29, 20268 min read

In brief

To audit cookies set before Accept, open the storefront in a clean browser profile, leave the banner untouched, and record cookies, storage, and network requests on first load. Repeat in isolated sessions after Reject All, after Accept All, and with Global Privacy Control on if you sell to California. Keep screenshots and timestamps. A banner is not evidence of blocking.

Hard boundary

This page explains how to observe cookies, storage, and network requests before Accept. It is not legal advice and not a GDPR, ePrivacy, CPRA, or other compliance certificate. A free US-baseline scan is one technical record outside California, not an EU or California conclusion.

Why the first load is the real test

A cookie audit before Accept asks which cookies, storage entries, and network requests appear on a clean visit before the visitor clicks Accept. Load once in a clean profile, leave the banner untouched, and record cookies, storage, and Network. Label the run Fresh. First-party wrappers still count if they set marketing or recording IDs early. A free US-baseline scan is not an EU or California legal conclusion. A banner is a control on the page, and it is not that record.

The usual failure is marketing, analytics, or advertising tags that load while the banner is still sitting there. Treat that as a technical observation: which cookies were set, which requests were sent, which scripts loaded, and when. That observation is not a legal verdict.

Strictly necessary cookies may appear before any click. A pixel can send a third-party request without writing a cookie. Google tags that use consent mode can still send network traffic when advertising or analytics storage is denied, including cookieless or redacted requests depending on the setup. If you only export the cookie table, you will miss that traffic.

Prep: isolate the session

Close every private window first, or use a separate browser profile. Extra private windows can share cookies and storage. Leave out extensions that inject analytics, or you will record the extension instead of the storefront.

Open the public HTTPS storefront URL only. Skip admin previews, theme editors, and staff accounts. Open DevTools before the first load so the Network panel records the first document; Chrome only logs network activity while the panel is open.

If you claim an EU or California result, the visit has to come from a real regional network path. Browser locale, timezone, and Shopify market configuration do not replace regional IP evidence. The free ConsentProbe audit is one US-baseline visit outside California; EU and California products are listed on pricing.

Cookie audit steps before Accept. Load the homepage once. Do not click Accept, Reject, settings, or a close control. If you also care about a product page, open it in the same untouched session after the homepage capture. For the next cookie audit, open the testing hub.

Load the public homepage and wait until the banner is visible or it is clear that no banner appeared.
In the Application panel, record Cookies, Local Storage, and Session Storage for first-party and third-party origins.
In the Network panel, note third-party hosts, analytics or ads domains, and any request that ran before interaction. Capture initiator when Chrome shows it.
Screenshot the banner state, the cookie list, and the key requests. Label the files as fresh, with a timestamp.

Reject All in a new profile

Start another clean profile. Do not reuse the fresh-visit context. Click the control that actually means reject all, decline optional purposes, or the equivalent on that banner. Then reload or navigate once more so delayed tags have a chance to run.

Compare marketing and analytics requests and non-essential cookies with the fresh run and with a later Accept All run. Confirm the click produced an observable change: the banner closed, a CMP cookie or consent key changed, or a documented CMP API reported the new preference. A click with no state change is a weak reject test.

Matching hostnames after Reject and after Accept do not prove the CMP was ignored. The same first-party CDN, a necessary endpoint, a consent-mode ping without analytics cookies, or a banner that never finished loading can look alike. Record what stayed, what stopped, and what you could not classify.

Open a new clean profile on the same public URL.
Complete Reject All and record the control text plus the time.
Confirm an observable preference or banner-state change before you trust the click.
Reload once, then recapture cookies, storage, and Network.
Keep a screenshot of the post-reject banner or preference surface.

Accept All as the inventory baseline

Start a third clean profile. Accept All, then capture which vendors, cookies, and requests appear only after that choice. That list is your post-consent inventory for this URL and this browser, not a proof that every integration is lawful.

The useful comparison is the set that appears after Accept and stays off after Reject. If a chosen tag never loads after Accept, check consent conditions, blockers, load failures, and whether the consent signal reached that tag.

Open a new clean profile on the same public URL.
Complete Accept All and record the time.
Reload once and recapture cookies, storage, scripts, and Network.
Mark vendors that appeared only after Accept as post-consent inventory.

California-facing optional: GPC on

Global Privacy Control is a user-enabled signal for opting out of sale or sharing of personal information. California's Attorney General describes it as a switch on some browsers, such as Firefox, DuckDuckGo, and Brave, or as a browser extension. GPC is a sale-or-share opt-out; limited data use, first-party analytics, and necessary requests can continue.

Run a clean session with GPC off and a matching session with GPC on. Change only the signal. Choose a browser or extension that sends GPC, then confirm the HTTP header and the JavaScript property on that visit.

In the Network panel, open the matching storefront request and read Sec-GPC under Request Headers. In the Console, evaluate navigator.globalPrivacyControl. Record both results next to the GPC-off session so you can tell a missing signal from a storefront that received GPC and still sent advertising traffic.

Confirm the GPC-off baseline with a clean California-facing visit if you claim that region, including IP evidence.
In a new profile, enable GPC with a browser or extension that sends the signal.
In the Network panel, open the matching request and read Sec-GPC under Request Headers.
In the Console, read navigator.globalPrivacyControl.
Compare advertising and sale-or-share-style requests with the GPC-off session, keeping necessary traffic separate.
Screenshot any visible opt-out acknowledgement and the Network difference.

What good looks like on the wire

Use this as a behavior checklist. Necessary cookies may still be set on the fresh load. Cookieless requests can still be sent. GPC is a sale-or-share opt-out signal; necessary traffic can continue.

Observable checks by consent state. This is a technical checklist, not a legal pass or fail.
State	Expect to see	Review further
Fresh, no click	Necessary cookies and first-party functional storage; marketing and ads tags waiting	Analytics, ads, or pixel identifiers set or sent before any choice
After Reject All	Non-essential marketing and ads stay off after a verified reject	Same non-essential third-party traffic as Accept, without a verified preference change
After Accept All	Chosen categories load; this is the inventory baseline	Chosen tags never load: check consent conditions, blockers, or a load failure
GPC on, California-facing	Sale-or-share-style advertising requests reduced versus the matched GPC-off run	GPC never verified, or pixels sent before the CMP can read the signal

Evidence to hand to engineering or legal

Point each claim at one artifact: cookie name and domain, request URL, timestamp, and a screenshot of the banner plus Network or Application. Sanitize query values before you share the pack.

ConsentProbe records cookies, storage, requests, and screenshots from a browser visit and attaches findings to that evidence. The free path is one US-baseline session.

DIY compared with a saved US-baseline audit

DIY is easy to contaminate with extensions or a reused profile. Save the first-load check as a US-baseline report on the public storefront URL. EU and California products are listed on pricing.

FAQ

Can cookies be set before I click Accept?

Yes. Strictly necessary cookies may be set on first load. Analytics, ads, and marketing tags are the ones this checklist treats as waiting for an affirmative choice in opt-in regions. The audit records what the browser actually set and sent. Request-only pixels can still send traffic without a cookie.

Is a cookie banner enough?

No. The banner has to change what the browser sets and sends. If Reject All and Accept All produce similar non-essential traffic, investigate wiring, timing, and cookieless pings, and confirm the reject action changed observable state before you escalate.

What is a cookie audit before Accept?

A Fresh-labeled check of cookies, storage, and requests before any Accept click.

How is this different from the testing hub?

This page is the before-Accept how-to. The hub picks which cookie audit to run next.

What should I capture for legal or engineering?

Screenshots of the banner, cookie tables, and key third-party requests, labeled by scenario (fresh, reject, accept, GPC) with timestamps. Include initiator and whether the CMP action was verified. Strip secrets from query strings before you share the pack.

Does a US scan prove GDPR compliance?

No. A US-baseline visit is a technical record for that visit profile. EU conclusions need EU-context scenarios with regional IP evidence, not a translated locale. California conclusions need a California-facing path plus, when claimed, a verified GPC comparison.

How is an audit different from a CMP?

A CMP is the banner and preference layer. An audit measures whether tracking respects the recorded choice, including request-only and cookieless traffic. Shopify can gate app and custom pixels through Customer Privacy settings; theme scripts still need a storefront check.

These live guides cover pieces of the same method. See the cookie audit product page for that browser recording.

Sources

These links cover the platform and regulatory context used in this guide. Applicability still depends on the organization and jurisdiction.

Save a US-baseline technical record

After a DIY check, run a free US-baseline audit: one browser visit outside California, with cookies, requests, and screenshots stored as evidence. That visit does not run EU reject/accept or California GPC. EU, California, and Global 2 audits can be purchased from Billing after sign-in.

Start a free audit View pricing