CMP claims vs runtime evidence: how do you prove the banner actually works?

Not legal advice

This page is a technical comparison method for Shopify and DTC storefronts. It is not legal advice, not a CMP vendor ranking, and not a fine estimate. Locale and timezone do not stand in for a regional IP when the claim is about the EU or California. Counsel still owns the legal reading.

Short answer

Treat the CMP statement as a hypothesis. Check it with cookies, storage, scripts, and requests from clean browser profiles that change only the consent signal you care about.

Write the claim in one sentence before you open DevTools. "Reject All blocks non-essential tags" can be checked. "We respect your privacy" cannot, until you turn it into a specific expect about a cookie name or a request host.

When the same hosts appear after Reject and after Accept, the recorded choice did not change the wire in the way the claim described. Name the hosts. Keep a separate list for requests you could not classify as marketing or analytics.

Map each claim to a scenario pack

Pick the smallest scenario set that can observe the sentence. The pre-consent audit checklist is the shared pass order: a fresh load, storage, Reject All plus one navigation, and an accept baseline. Use that hub when you need the full table. This page maps claim wording onto those passes.

A GPC claim needs its own pair. Run it on a California-facing path, once with the signal off and once with the signal on. A free US-baseline visit does not produce that pair, and it does not produce an EU reject conclusion. Read the free versus paid scope page before you quote a regional line.

DIY verification steps

Keep the URL and the wait time stable. Change only the consent action or the GPC signal. Label every export with the scenario name, the URL, and the time.

1. Copy the exact CMP or policy sentence you are testing.
2. Choose the row in the table that matches that sentence. If the sentence mixes reject and GPC, split it into two packs.
3. Run each scenario in a new profile. Confirm the action or the GPC signal changed observable state, such as the banner label or a request header of Sec-GPC: 1.
4. Diff cookies and Network hosts across scenarios. List what stayed, what stopped, and what you could not classify.
5. Attach screenshots of the CMP surface plus the Application and Network panels to the claim sentence.
6. On Shopify, note whether the request came from an app pixel, a custom pixel, or a theme script. The Customer Privacy API records consent. A theme script still loads unless its own code waits. Read that limits page before you blame the banner.

Rows you can copy into the pack

Use these as fill-in patterns. They are not measurements from a named shop.

Fresh load. If Network shows a request to a marketing host such as connect.facebook.net, www.googletagmanager.com, or analytics.tiktok.com before any click, the no-tracking-before-choice row fails for that URL. Save the request URL, the scenario name fresh, and a screenshot of the untouched banner.

Reject All. If a cookie such as _ga on the shop host is present after Reject and also present after Accept, the reject claim fails for that storage key. First-party only names the host. Read the first-party versus third-party guide before you drop the key because the domain matches the shop. The Reject All leftovers page walks the cookies and pixels that remain after the click.

GPC. If the GPC-on visit sends Sec-GPC: 1 and the same ads host still appears as in the GPC-off visit, the honor-GPC claim fails for that host. The GPC test guide shows how to confirm the header. This page uses that pair as the check against the claim sentence. The GPC versus CMP claims guide covers the mismatch diagnosis in more detail.

Consent Mode is a tag signal. A denied or granted state in a dataLayer push still needs the raw request and cookie check, including cookieless pings. Google's consent-mode docs describe the signal. They do not replace the Network panel on your shop.

Evidence pack

A shareable pack names the claim, the scenarios, timestamps, cookie names with domains, key request URLs, and sanitized screenshots. Strip query values that carry identifiers before you share it.

Partial suppression is a technical observation. One quiet category does not turn the whole sentence into an honor result. Write which categories stopped and which hosts stayed.

ConsentProbe maps findings to request, cookie, and screenshot IDs after a saved run. Use a free US-baseline visit when you need that stored technical record outside California. Open pricing when the claim needs an EU fresh, reject, and accept pack, or a California GPC pack.

FAQ

Related guides

Read the pre-consent audit checklist for the pass order, the reject leftovers page and the GPC versus CMP page for the two common mismatches, and the free versus paid page before you quote a region.

• Pre-consent audit checklist: what to verify before Accept
• Reject All Still Tracking: What to Check After You Say No
• GPC vs CMP Claims: How to Spot a Mismatch
• What does a free US-baseline cookie audit prove vs paid EU or California scans?
• Shopify Customer Privacy API does not block scripts
• First-party vs third-party cookies before consent: what should you check?
• Consent Mode vs Raw Pixel Requests: A Storefront Checklist
• Runtime Audit vs CMP: What Each One Measures
• How do you read a cookie audit report?
• Shopify pre-consent checklist: what to check before Accept
• ConsentProbe methodology
• Sample report
• Pricing and listed regional products