Check cookies on your website: does it set cookies before consent?

You can check cookies on your own website in five minutes, without extra software. Open your site in a Chrome private window, do not click the cookie banner, and look in the developer tools at which cookies are already set and which trackers are already sending data. If _ga, _fbp or _gcl_au are there after the page loads, or hits leave for Google, Meta or LinkedIn, your site is not waiting for consent.

This is not a theoretical problem. On 6 October 2026 we loaded 37 Belgian websites in a real Chrome browser without clicking anything. 20 of those sites used tracking. On 14 of them, tracking cookies were already set or non-denied hits were sent before the visitor had made a choice. 4 sites sent Google Analytics 4 hits without Consent Mode, 2 sites granted consent by default and only 10 sites got it right: everything denied until the visitor chooses. This guide shows you how to run the same test yourself.

Why is a cookie banner not enough?

A banner is only the question. What counts is what happens technically while that question is still open. The Belgian Data Protection Authority (page in Dutch) is clear: no cookie that is not strictly necessary may be placed or read until the user has given consent. Analytics cookies are included, because according to the authority they are not needed to deliver the service the visitor asked for.

A banner that appears nicely while Google Analytics, the Meta pixel and the LinkedIn Insight Tag are already firing in the background does not follow that rule. And you cannot see it by simply looking at your site. Hence this test.

How to check cookies on your website in 5 minutes

All you need is Google Chrome. Other browsers work too, but the menus have different names.

1. Open a private window (Ctrl+Shift+N, on Mac Cmd+Shift+N). You start without earlier cookies or saved choices.
2. Open the developer tools before you load the site. Press F12 and choose the Network tab. Tick “Preserve log” so you miss nothing on a redirect.
3. Load your homepage and click nothing. Not the banner, not the page. Wait ten seconds or so and scroll down, because some tags only fire on scroll.
4. Look at the cookies. Go to the Application tab, open Cookies on the left and click your domain. Note what you see. Check the other domains in that list too.
5. Filter the network traffic. Type these search terms one after another into the Network filter: collect, facebook.com/tr, px.ads.linkedin, analytics.tiktok, clarity and hotjar. Every line that appears is a tracker already sending data.
6. Read Google’s consent state. Click a g/collect request (Google Analytics 4) or a Google Ads request and look for the gcs parameter in the URL. More on that below.
7. Repeat after “Reject”. Open a new private window, click “Reject all” this time and check whether marketing trackers still fire afterwards.

If you use Google Tag Manager, you can see the same sequence in Tag Assistant: select the first Consent event and check in the Consent tab that the four Google signals are set to denied before any tag fires.

How do you read the gcs parameter?

Google sends the consent state along with every hit. According to Google’s consent mode documentation, the gcs parameter transmits the visitor’s choice for ad_storage and analytics_storage. In practice we see three patterns:

• gcs=G100: both signals are denied. Consent Mode works and is waiting for a choice. This is what you want to see before the click.
• gcs=G111: both signals are granted. If you see this before anyone clicked “Accept”, your site grants consent by default.
• No gcs: Consent Mode is not set up. Google does not know whether there is consent, and the tag simply fires.

Other combinations, such as G110 or G101, mean that one of the two signals is granted. That should not happen before a choice either.

What you see, what it means and what to do

What do the rules say in Belgium and the Netherlands?

Belgium. The Data Protection Authority requires prior consent for every cookie that is not strictly necessary, analytics cookies included. Pre-ticked boxes do not give valid consent, withdrawing must be as easy as giving, and a cookie wall that blocks the site for people who refuse does not comply with the GDPR according to the authority. How your banner meets these rules is covered in cookie banner rules in Belgium.

The Netherlands. The Dutch Autoriteit Persoonsgegevens checks websites with its own software. In April 2025 it sent its first 50 warning letters (in Dutch), among others to sites that placed cookies before the visitor agreed, sites where refusing took more clicks than accepting, and sites with pre-ticked boxes. The authority aims at 500 sites a year.

If your test shows trackers firing before a click, your site does not follow the Belgian authority’s guidance. That is a finding, not a verdict: it is almost always a technical error that is quick to fix.

The five causes we see most often

1. A hardcoded tag in the theme. The Google tag or the Meta pixel sits directly in the <head>, next to the version in GTM. The consent tool controls the GTM version, but the hardcoded one always fires.
2. A plugin that loads its own pixels. WordPress and webshop plugins for analytics, chat or reviews often load their own trackers, outside your consent tool.
3. A tracker in the wrong category. Your consent tool’s scan puts an unknown cookie under “necessary” or “unclassified”, and nobody looks at it.
4. The consent tool loads too late. In GTM it sits on All Pages instead of Consent Initialization, so the first hit leaves without a consent state.
5. Defaults set to granted. Someone set the default consent to granted “so we don’t lose data”. That gives you no usable data, only a bigger risk.

How to fix it

The fix always follows the same line:

• One place for all tags. Remove hardcoded scripts from the theme and manage everything through Google Tag Manager.
• A consent tool that is installed correctly. For example Cookiebot through the official template, on the Consent Initialization trigger, with denied as the default for ad_storage, analytics_storage, ad_user_data and ad_personalization.
• Consent Mode v2 for Google Ads. Without the four signals, Google treats your EEA traffic as not permitted. See how in Consent Mode v2.
• Tie non-Google tags to consent. Meta, LinkedIn, TikTok and Hotjar only fire after the right consent.
• Test again. Repeat the five-minute test after every theme update, new plugin or new tag.

If you want to depend less on what the browser does, server-side tagging is a next step. It does not replace consent, but it gives you more control over which data goes where.

Rather not do it yourself?

You can also run the same check automatically with our cookie scanner: you see which cookies and trackers your site sets before a click and which consent state Google receives.

Want to be sure the whole chain is right, from consent to GA4, Google Ads and Meta? Start with a tracking audit. Would you rather have it set up properly straight away? Our tracking specialist installs your consent tool, Consent Mode v2 and the tests. Price on request.

Frequently asked questions