# How to check that no cookies are set before consent

> A step-by-step DevTools test to confirm that no analytics or ad cookie, storage entry or tracking request happens before the visitor makes a choice.

Source: https://cookiequiet.com/guides/check-cookies-before-consent
Published: 2026-10-21
Publisher: Cookiequiet

## Steps

1. **Start clean** Open a fresh browser profile, or clear the site's data from the Application panel, so no earlier choice is stored.
2. **Prepare DevTools** Open DevTools before loading the page. In Network, tick Preserve log and Disable cache, and enable the 3rd-party requests filter.
3. **Load the page without clicking** Load the page and leave the banner untouched for a few seconds so that lazy scripts have time to run.
4. **Read cookies and storage** In Application, check Cookies for every origin, then Local storage and Session storage. Only strictly necessary items should be there.
5. **Read the network requests** List the third-party hosts contacted. Analytics, advertising and session recording hosts should not appear, except cookieless pings if you chose Consent Mode advanced.
6. **Click Reject all and reload** Check that no new cookie, storage entry or tracking request appears after the refusal and on the next page.
7. **Click Accept all** From a clean state, accept and confirm the expected cookies and requests now appear, which proves the tags are held rather than broken.
8. **Record and repeat** Save screenshots with the date, and repeat on each main template and after every tag change.

To check that nothing is set before consent, open your site in a clean browser profile with the developer tools already open, load the page without touching the banner, then read two panels: the cookies and storage in the Application tab, and the requests to third-party hosts in the Network tab. Only strictly necessary items should appear. Then click Reject all and repeat: nothing new should appear. The whole test takes about five minutes per page, and it is the same check a regulator's investigator runs.

## Why test it yourself?

Because a banner on the screen proves nothing about the scripts behind it. The CNIL's largest cookie fines, including Shein (€150 million, decision of 1 September 2025) and American Express (€1.5 million, decision of 27 November 2025), cite cookies placed before the visitor chose or after they refused. Tag managers, plugins and hard-coded snippets added by someone else are the usual cause, and they change without anyone touching the banner.

## What are you looking for?

Three kinds of evidence, because article 5(3) of the ePrivacy Directive covers storing and reading information on the device, not only cookies:

- **Cookies** from analytics and advertising: names such as `_ga`, `_gcl_au`, `_fbp`, `_uetsid` or `_uetvid`, and third-party cookies on ad domains.
- **Local and session storage** entries written by trackers.
- **Requests to tracking hosts**: analytics collection endpoints, advertising pixels, session recorders. The EDPB's guidelines on the technical scope of article 5(3) treat tracking pixels and similar techniques as covered too.

What may be there before a choice: the consent cookie itself, a session cookie, a load balancer or security cookie, a shopping cart. Those are strictly necessary for a service the visitor asked for.

## How do you prepare the browser?

Use a fresh browser profile, or clear the site's data first (Chrome: Application, Storage, Clear site data). A private window works for first-party cookies, but note that Chrome's incognito mode blocks third-party cookies by default, and Safari blocks them in every window, so a private window can hide the very cookies you are looking for. The Network tab still shows the requests either way, which is why it is the more reliable evidence.

Open DevTools before loading the page (F12, or Cmd+Option+I on a Mac). In the Network panel, tick **Preserve log** so requests survive reloads, and **Disable cache** to behave like a first-time visitor.

## How do you run the test?

Follow the numbered steps below the article; here is what to look at in each panel.

**Application, Storage, Cookies.** Chrome lists cookies per origin with Name, Value, Domain, Path, Expires / Max-Age, HttpOnly, Secure and SameSite. Select your site's origin and read the names. Check every origin in the list: third-party cookies appear under the frames that set them. Then look at **Local storage** and **Session storage** in the same panel. In Firefox, the Storage tab shows the same information.

**Network.** Under the filter bar, open **More filters** and tick **3rd-party requests** to show only requests to other origins. Look for analytics and advertising hosts: google-analytics.com, googletagmanager.com, doubleclick.net, facebook.com, connect.facebook.net, bat.bing.com, clarity.ms, hotjar.com, analytics.tiktok.com. Click a request and open its **Cookies** tab to see cookies sent or set by it.

**Console.** Typing `document.cookie` lists the cookies readable by scripts (not HttpOnly ones). If your banner marks blocked scripts with `type="text/plain"`, `document.querySelectorAll('script[type="text/plain"]')` shows the tags waiting for consent.

## How do you read the results?

| What you see before any click | Verdict |
|---|---|
| Only the consent cookie and a session cookie | Fine |
| A `_ga` or `_fbp` cookie | Analytics or ad tag running before consent |
| Requests to facebook.com/tr or bat.bing.com | Ad pixel firing before consent |
| Requests to google-analytics.com but no `_ga` cookie | Likely Consent Mode in advanced mode sending cookieless pings |
| A YouTube or Maps iframe loading | Embed not held until consent |
| Third-party cookies from a chat or font host | Widget loaded eagerly |

The Consent Mode row deserves a word. In advanced mode, Google tags load with consent denied and send measurements without cookies; that is Google's design, and whether such pings are acceptable before consent is a question for your supervisory authority. If you want nothing sent to Google before a choice, use basic mode, as described in [the Consent Mode guide](/guides/google-consent-mode-v2).

## What do you do when something leaks?

Find where the tag comes from: the page source (hard-coded), the tag manager (a trigger on page view), a CMS plugin, or a script that loads another. Then block it: mark the script tag so it waits for its category, move embed URLs to a placeholder attribute, or change the tag manager trigger to a consent event. [Block scripts until consent](/guides/block-scripts-until-consent) covers the four methods. Retest after every fix.

## How often should you repeat it?

After every change to the tag manager, every new plugin or embed, every theme update, and at least monthly on the main templates: home, an article, a product page, the checkout, a page with a form. Add the test to the [cookie audit checklist](/guides/cookie-audit-checklist). Keep a screenshot of each panel with the date; it is useful evidence if a complaint arrives.

## Can a scanner do this for you?

Partly. A scanner crawls more pages than you will test by hand and names the providers it finds. Cookiequiet's [free cookie scanner](/tools/cookie-scanner) checks 5 pages without an account, reads scripts, iframes and Set-Cookie headers, and detects whether Consent Mode and another consent tool are present. Its limit is that it reads the HTML without running JavaScript (unless the rendered-HTML option is configured), so cookies set purely by scripts are listed from its provider database rather than observed. The DevTools test above is what confirms the behavior in a real browser. If the test shows leaks, Cookiequiet's setup is one script tag placed before your other scripts, with Reject all on by default, Consent Mode v2 switched on in the snippet the dashboard gives you, and an auto-blocker that holds about 80 known trackers until consent.

## Questions

### Is the consent cookie itself allowed before consent?

Yes. Storing the visitor's choice is strictly necessary to respect it, so the cookie that records consent or refusal does not need consent. Its name and duration belong in the cookie policy.

### Why do I see no third-party cookies in a private window?

Chrome's incognito mode and Safari block third-party cookies by default, so they do not show up in the storage panel. The network requests to the tracking hosts still appear, and that is the evidence to look at.

### Is a request to Google Analytics before consent always a problem?

It depends on how it is set up. With Consent Mode in advanced mode, Google tags send cookieless pings while consent is denied, by design. Some authorities may view any request to a tracker before consent as a problem, so basic mode is the conservative choice.

### Can I trust an online cookie checker instead?

Use it to cover many pages, but confirm in a real browser. Many checkers do not run every script or interact with the banner, so they can miss tags that fire after a delay or on scroll.

## Sources

- [Chrome for Developers, View, edit, and delete cookies (DevTools Application panel)](https://developer.chrome.com/docs/devtools/application/cookies)
- [Chrome for Developers, Network features reference (Preserve log, Disable cache, 3rd-party requests filter)](https://developer.chrome.com/docs/devtools/network/reference)
- [Directive 2002/58/EC (ePrivacy Directive), article 5(3)](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [EDPB, Guidelines 2/2023 on the technical scope of article 5(3) of the ePrivacy Directive](https://www.edpb.europa.eu/documents/guideline/guidelines-22023-on-technical-scope-of-art-53-of-eprivacy-directive_en)
- [CNIL, Cookies placed without consent: SHEIN fined 150 million euros (decision of 1 September 2025, press release of 3 September 2025)](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil)
- [CNIL, Cookies: AMERICAN EXPRESS fined €1.5 million by the CNIL (decision of 27 November 2025, press release of 3 December 2025)](https://www.cnil.fr/en/cookies-american-express-fined-eu15-million-cnil)
- [Google, Consent mode concepts: basic and advanced implementation](https://developers.google.com/tag-platform/security/concepts/consent-mode)