How often should I re-run a cookie consent audit?

Not legal advice

This FAQ explains an observation cadence for re-running cookie consent audits after storefront changes. It is not legal advice, not a statutory re-audit mandate, not a counsel calendar, and not a GDPR, ePrivacy, CPRA, or other compliance certificate. ConsentProbe reports are technical observations of what fired. They do not say what counsel would allow, and they do not say how often counsel requires a formal review. Observation is not counsel permission.

Last updated September 28, 2026. The testing hub owns which test to run next. The pre-consent checklist owns the pass order. The retest-after-fix guide owns the rerun after a Reject or GPC fix. The CMP-switch guide owns the rerun after a vendor migration. This page does not rewrite those guides. It answers when a prior Fresh and Reject pack goes stale.

Short answer

Re-run a cookie consent audit when the storefront tracking surface changes. Useful triggers include a new marketing pixel or tag, a theme or app change, a CMP switch or a major banner config change, and seasonal campaign tags that only exist for a few weeks. This page does not set a statutory interval.

A prior Fresh and Reject pack goes stale when the scripts, apps, or consent wiring that produced it are no longer the ones live on the storefront. Treat cadence as observation hygiene. Run Fresh and Reject again after the change, keep the evidence pack, and open the hub or the checklist when you need which test is next.

After a Reject or GPC fix, retest the path you fixed. After a CMP migration, retest claims against runtime. The retest-after-fix guide and the CMP-switch guide own those reruns. This page does not paste them.

Triggers that stale a prior pack

A quiet calendar and a changed storefront are different facts. Write the reason as the change you shipped, then rerun Fresh and Reject. Leave any formal review schedule with counsel.

Why a fixed calendar alone is weak

A quiet month with no tag changes may not need a new pack. A loud week with three new pixels does. The trigger is the change, not a date this page invents.

An Accept-only capture, or one old Accept file, does not prove Fresh and Reject still hold after a change. The Reject-if-Accept FAQ covers that split. This page does not paste it.

CMP marketing copy and auto-block claims change with vendor versions. Runtime is the check. The claims-versus-runtime guide and the CMP-switch guide own those comparisons. This page only points at them.

Counsel may set a formal review schedule. This page does not invent that schedule. Ask counsel for mandate questions. Observation is not counsel permission.

Fresh and Reject after a trigger

These steps refresh the pack after a named change. They do not install a CMP, rank vendors, or set a legal calendar. The testing hub and the pre-consent checklist say which pass is next. The retest-after-fix guide and the CMP-switch guide own their own reruns.

1. Note the change, whether it is a pixel, a theme or app, a CMP, or a campaign, and write the date.
2. Use a clean profile. Load the storefront once. Do not click Accept. Capture Network, cookies, storage, and the banner. Label the pack Fresh.
3. Open a new clean profile. Click Reject All. Navigate once. Recapture the same layers. Label the pack Reject.
4. Compare the new pair with the last pack for the same URL. Write one finding sentence per new or returned mismatch.
5. Keep the evidence pack with the change note.
6. If you just fixed Reject or GPC, follow the retest-after-fix guide. If you just switched CMP, follow the CMP-switch guide. For which test is next, open the hub or the checklist.

When the last pack is the only file

Waiting for a calendar reminder while tags keep shipping leaves Fresh and Reject unproven. After a trigger, ConsentProbe runs Fresh and Reject on the storefront URL. Each finding stays tied to a request, a cookie, or a screenshot.

Use the free US-baseline visit when you want the report format. Use paid EU or California scenarios when those regions are the claims. The free versus paid guide draws that line. ConsentProbe does not set a legal audit schedule, does not install a CMP, and does not issue a certificate.

FAQ

Limits of this page

This page tells you which storefront changes stale a prior Fresh and Reject pack, and which published guide to open next. It does not rewrite the testing hub, the pre-consent checklist, the retest-after-fix guide, or the CMP-switch retest. It is not legal advice, not a statutory re-audit mandate, and not a certificate. Observation is not counsel permission. ConsentProbe reports stay tied to requests, cookies, and screenshots. A free US-baseline scan is not an EU or California legal conclusion.

Related guides

Open the testing hub for which test is next, the pre-consent checklist for the pass order, the retest-after-fix guide after a Reject or GPC fix, and the CMP-switch guide after a vendor migration. The before-Accept audit and the evidence-pack page cover the first load and how to file it.

• Cookie audit hub: which consent test should you run first?
• Pre-consent audit checklist: what to verify before Accept
• How do you re-test after a GPC or Reject All fix?
• How to Retest After Switching CMP Vendors
• How to run a cookie audit before Accept
• What belongs in a cookie consent audit evidence pack?
• Reject All Still Tracking: What to Check After You Say No
• What does a free US-baseline cookie audit prove vs paid EU or California scans?
• CMP claims vs runtime evidence: how do you prove the banner actually works?
• Does Reject All stop marketing pixels?
• Do I still need a Reject All test if Accept All looks fine?
• ConsentProbe methodology
• Pricing and listed regional products