Consent test cases, for the scripts that fire before you agree

Almost every consent finding comes down to one of two things, and both are trivial to check. The first is processing that happens before a choice is made: a cookie set, or a request sent to an analytics or advertising endpoint, on a first visit with the banner still on screen. Blocking the cookie while allowing the request is a common half measure that does not help, because the request itself carries an identifier and an address. The second is asymmetry: accept on the first layer and reject buried behind a second screen. Consent obtained that way is not freely given, and the fix is a layout change rather than an engineering one.

Withdrawal is where implementations quietly fall short. Stopping tracking only on the next page load means the current session continues to be processed after the user said stop. Leaving the previously set identifiers in cookies, local storage and session storage means processing resumes on the next visit regardless of the recorded choice. And a withdrawal control that only exists in a footer link on the homepage is not as easy to reach as the banner that collected the consent.

The bypass routes are the technically interesting part. A tag manager that loads its own container and then injects tags will fire whatever it holds unless consent gates the tags rather than the container. An embedded video, map or chat widget sets its own cookies the moment it renders, so it needs a placeholder rather than a lazy load. Cookies misclassified as strictly necessary avoid needing consent entirely, which is why the essential list deserves reading line by line. And the consent script failing to load must fail closed, since failing open hands every ad blocker user straight past the gate.

Finally, two things that only appear in a real deployment. A page served from an edge cache must evaluate consent per visitor rather than baking one visitor state into the cached response. And the choice has to reach server side forwarding, because a great many products block the browser tag correctly and then send the same event to the same vendor from the backend, which is the same processing with a different transport.