How to check what your website runs before consent
Regulators look at what a page does before the visitor chooses. You can run a similar check in ten minutes with a normal browser.
Short answerOpen your site in a private window with no saved data, do not touch the banner, and look at three things in the browser's developer tools: cookies and storage, network requests, and the Google Consent Mode state in the data layer. Anything non-essential that appears before you choose is what a regulator would flag.
Why test before the visitor chooses?
The ICO's review of the UK's top websites checked whether advertising cookies were placed before or without consent, and whether rejecting was as easy as accepting (ICO, December 2025). The first of those is something you can check yourself.
Step 1: start clean
Open a private or incognito window, so no earlier choice or cookie is carried over. Firefox private windows send Global Privacy Control, which some consent platforms treat as a refusal; use Chrome or Edge to see what a first-time visitor sees. Open developer tools (F12) before loading the page, and keep the Network tab recording.
Step 2: load the page and do not touch the banner
Wait ten seconds. Scroll a little. Do not click anything in the banner.
Step 3: check cookies and storage
In the Application (Chrome) or Storage (Firefox) tab, look at Cookies, Local storage and Session storage for your domain and any third-party domains. For each entry, ask: is it strictly necessary for something the visitor asked for, or does an exception cover it? An analytics identifier or an advertising cookie at this point usually is not.
Step 4: check network requests
Filter the Network tab by third-party domains. Look for requests to analytics, advertising, session-recording and chat providers. A script downloading is not the same as storing data, but requests that send events or identifiers before a choice deserve a close look.
Step 5: check the Consent Mode state
In the Console, type dataLayer and look for a consent default entry with the four signals set to denied, before any Google tag event. Then click Reject all and check for an update entry.
Step 6: reject, reload and check again
Click Reject all, reload, and repeat steps 3 and 4. Nothing non-essential should appear. Anything that stays should be needed to remember the refusal, and your cookie policy should say so.
Where Sadang fits
We run this check on our own sites. Our cookie policy lists what Sadang stores and sends on this site before a choice and after one, including what stays after you reject everything.
This guide is general information, not legal advice. Laws and regulator guidance change; check the sources linked above and take advice on your own site.