Published August 15, 2026 · 9 min read · RegSentry blog
Here's the uncomfortable fact at the center of the website-privacy lawsuit wave: a cookie banner that displays a consent choice and a cookie banner that enforces one look absolutely identical to you and your visitors. The only place the difference shows up is in the network traffic — which nobody looks at. In our scans of 3,891 small-business sites, 61% fired at least one tracker before consent, and sites running a recognized consent platform fired at a higher rate than sites running none. This guide shows you how to check yours, step by step, with no technical background required.
Consent banners fail for boring, mechanical reasons — not because anyone chose to ignore privacy:
You'll use your browser's built-in developer tools. This sounds technical; it's really just opening a panel and reading a list. No changes are made to your site.
Use an incognito/private window so no previous consent choice is remembered. This matters — if you tested your site last month and clicked Accept, a normal window will replay that choice and hide the problem.
Press F12 (Windows) or Cmd-Option-I (Mac) to open developer tools, and click the Network tab. Then type your site's address and load it. The panel fills with every request the page makes.
This is the whole test. Your banner is on screen, unanswered. Everything now in the network list happened before consent. In the filter box, try each of these, one at a time: facebook, clarity, hotjar, tiktok, doubleclick, collect, hubspot, linkedin. Matches mean those tools contacted their servers while the banner sat unanswered.
Switch to the Application tab (Chrome/Edge) or Storage (Firefox) and expand Cookies. Names like _fbp (Meta), _ga (Google Analytics), _hjSession (Hotjar), or _ttp (TikTok) appearing before you've answered the banner mean tracking cookies were set pre-consent.
Now click Reject (or "necessary only") on the banner, then reload the page with the Network tab still open. Run the same filters. If the same tracker requests fire after an explicit rejection, your banner is recording opinions, not enforcing them.
Test your contact page, any intake or quote form, and checkout if you have one. Tracking setups differ page to page, and pages where visitors type personal information are exactly where recording tools are most sensitive.
Not every request in the network list is a tracker, so before you panic at a long list, sort it. Requests to your own domain are your site loading itself — fine. Requests for fonts, images, and stylesheets from content-delivery networks are page assets, not tracking. Your consent platform's own script has to load before consent by definition — that's the tool asking the question, and it's expected. The requests that matter are the ones to known tracking and advertising domains — the names from Step 3 — and any request that fires an "event," "collect," or "pixel" endpoint before the banner is answered.
Two edge cases worth knowing. Some analytics setups run in a deliberately consent-aware mode that sends cookieless pings while consent is denied (Google's Consent Mode does this in its "advanced" configuration) — those pings carry a denied-consent flag, and whether to allow them is a configuration choice you should make knowingly rather than by accident. And some tools fire only on interaction — a chat widget that stays quiet until scrolling, a recorder that starts on the first click — so scroll and move your mouse during the test before concluding a page is clean.
If the test came back clean — genuinely nothing firing before consent, nothing firing after reject — good news, and worth re-checking whenever a new tool is added. If you found trackers firing, the fixes group into three moves:
The blocking switches and Consent Mode integrations live in different places in each consent platform. We keep a verification guide for each of the major ones — what to enable, where it hides, and how to confirm it took effect:
Whichever platform you run: the platform manages consent, and this test verifies it. Those are different jobs, and the second one is yours.
The timing of tracker requests relative to consent is the exact technical fact at the center of the CIPA § 631 demand-letter wave — statutory damages up to $5,000 per violation, argued per visitor session. A banner that doesn't block doesn't change the network log, and the network log is what automated plaintiff-side scanners read. Ten minutes of verification is the difference between believing you're fine and knowing it.
If you'd rather not do the DevTools work by hand, our free cookie consent checker runs the same test in a real browser — banner unanswered, network log recorded — and shows you every tracker that fired before consent, in about 30 seconds.
See what fires on your site before visitors consent — free, 30 seconds, no signup.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.
If you'd rather have the site watched continuously — with an email the moment a new tracker appears — that's what monitoring is for ($99/mo, cancel anytime).