Written by 4SYSTEMPublished on Updated on
8 min read
To check Google Analytics consent, test what the browser does before any choice, after refusal, after agreement then after withdrawal. A visible banner or a “denied” status in a tool does not alone prove the absence of requests or the legal validity of the device. Google distinguishes between a basic consent mode which blocks beacons until the consent process and an advanced mode which can send measurements without cookies when consent is refused.[32] So examine beacons, storage and network together, then validate the applicable framework. Technical inspection demonstrates behavior, not general compliance.
- To remember: distinguish interface, state and collection
- Adjust consent Google Analytics according to your installation
- Understanding basic and advanced without legal shortcuts
- Prepare a clean and reproducible acceptance testing
- Check before choice and after refusal
- Check agreement, opt-out and next navigation
- Browser Control Matrix
- Fictitious example: a refusal respected by a container, not by an extension
- Limits and conservation of evidence
- Frequently asked questions
- Next step: test the four states
To remember: distinguish interface, state and collection
The visitor expresses a choice in an interface. The solution transmits a state to the tags. Tags and integrations then execute their behavior. These steps may differ. Your acceptance testing should check the entire channel rather than just the appearance of the banner or the parameter displayed in the tag manager.
Adjust consent Google Analytics according to your installation
Inventory the tag container, directly installed scripts, site extensions, and external integrations. A single page can load multiple measurement paths. The banner can drive one while letting another start independently.
Describe the purposes and tools actually present. The CNIL recalls the principle of prior consent for the storage or access to certain terminal information, with limited exceptions, and the conditions for withdrawal.[31] Do not assume that a measurement tool has an exemption based on its name alone.
The measurement plan guide GA4 of 4SYSTEM helps define useful events. This selection does not replace the collection frame. A sober measure must also have behavior adapted to the choices and documentation consistent with the treatments actually carried out.
Understanding basic and advanced without legal shortcuts
In the basic version described by Google, tags are prevented from loading before interacting with the banner; when the person does not consent, no data is transmitted to Google by these tags, not even the consent state.[32] Verify that your installation actually matches this description.
In the advanced version, tags load with default states and can send metrics without cookies when consent is denied. After agreement, they adapt their behavior for the planned collection.[32] “Cookie-free” therefore does not necessarily mean “without network request”.
These options describe a technical architecture. They do not alone determine the legal basis, the necessary information or the conformity of your site. Have the chosen method and the data actually transmitted examined by the competent person. Do not present consent mode as a certificate of conformity obtained by activating an option.
Prepare a clean and reproducible acceptance testing
Use a clean browser profile or a test context whose storages are controlled. Note the page, site version, browser and settings. Open the development tools before navigation to observe the first requests, not just those sent after displaying the banner.
Examine cookies and other relevant storage, loaded scripts, and measurement queries. Preserve useful domain names and behaviors without exporting unnecessary personal identifiers. Proof must make it possible to link a request to a state and a moment in the journey.
Prepare representative pages: arrival, internal navigation, form and confirmation when these steps exist. Some scripts only load after an action or on a particular route. A home page check does not validate pages that have different integrations.
Check before choice and after refusal
Before clicking, observe what starts. Compare this behavior to the validated architecture. For an installation intended to block any Google collection before agreement, an unexpected request must be examined even if no analytics cookie appears.
Then choose decline and navigate. Verify that the choice remains applied and that directly installed scripts do not bypass the container. Google specifies that the choices must be communicated and ensure that the Google and third-party tags behave according to them; Not all tags have the same built-in controls.[32]
Don't conclude just from a query name. Review the timing, domain, relevant settings, and active configuration. A ping without cookies provided by advanced and a complete collection triggered despite refusal do not describe the same behavior. The legal qualification of architecture remains separate from this technical observation.
Check agreement, opt-out and next navigation
After agreement, verify the status update and expected events, without duplication due to multiple upload paths. A site may respect the initial block but load two installations upon acceptance. The acceptance testing must therefore examine the accuracy of the measurement as much as its start.
Then test the removal from the intended access. The CNIL reminds that the user must be able to withdraw consent at any time with the same simplicity as they granted it.[31] Check the interface, the new value transmitted and the behavior of the tags after modification.
Navigate to another page and reload. The system must enforce the defined persistence rule, without silently reinstating a removed agreement. Also look at the storages and what the implementation plans for them. Withdrawal does not automatically erase all data already processed; This subject requires distinct analysis and approaches.
Browser Control Matrix
| State tested | Expected interface | Technical evidence to be collected | Question to be resolved |
|---|---|---|---|
| New visit | Accessible choices and consistent information | Tags, storage and network before action | Are the default values respected? |
| Refusal | Choice understood and preserved according to the rule | State transmitted and possible requests | Does the behavior correspond to the validated mode? |
| Agreement | Activation of chosen purposes | Expected events and parameters | Does a dual installation appear? |
| Withdrawal | Simple access to modification | Update and following behavior | Does the collection really adapt? |
| Internal navigation | Choice kept depending on the configuration | Control of another route | Does a script bypass the device? |
| New session | Persistence complies with the rule | Storage and reread state | Does an old value reactivate a retired choice? |
Add a precise verdict per box: expected behavior, observed deviation or insufficient evidence. An unobserved line does not turn green because the banner bears the logo of a known supplier.
Fictitious example: a refusal respected by a container, not by an extension
An imaginary company configures a basic block in its tag manager. The acceptance testing starts on a clean browser. No events leave from the container before agreement, but a confirmation page loads another Analytics installation added by an extension.
In this illustrative scenario, the team identifies this second path and attaches it to the validated device or deletes it depending on the technical decision. She then redoes the tests before choice, after refusal, after agreement and after withdrawal on the pages concerned. Just checking the container would not have revealed the problem.
Another test concerns an advanced configuration. Requests without cookies are observed after refusal. The team does not automatically classify them as bugs or compliance: it checks their nature, the Google documentation and the applicable analysis. No actual legal audit or client results are fabricated; the example shows why network and storage must be read together.
Limits and conservation of evidence
Keep the settings and site version corresponding to the captures. An old proof does not validate an extension added later. Retest after a change of banner, container, theme or instrumented path. Update responsibilities should be explicit.
The acceptance testing alone does not cover all data protection obligations, contracts, transfers or complete information. She provides technical comments for the review. The absence of a cookie in a panel does not demonstrate the absence of processing; an observed request requires an appropriate qualification.
Frequently asked questions
Does the consent mode collect consent?
It adapts the behavior of tags to states, but does not replace your interface of choice or the necessary information. Google asks to collect the choices, communicate them and check the behavior of the tags.[32] The quality of the collection and its legal framework must be examined separately from the technical option.
Should a denial always delete any Google request?
The behavior depends in particular on the mode described by Google: basic blocks transmission in the absence of consent, while advanced can send measurements without cookies.[32] Check the mode actually installed and validate its use. Do not infer compliance or violation from this contrast alone without examining the device.
Is a correctly displayed banner sufficient to validate?
No. It only proves part of the interface. Test passed states, scripts, storage, and networking on relevant pages. Also control removal and subsequent navigation. An integration added directly to the site may ignore the container even though the banner appears to function normally for the visitor.
Next step: test the four states
Prepare a acceptance testing before choice, refusal, agreement and withdrawal on a clean browser. To frame the connections between site, beacons and measurement, consult the 4SYSTEM services. Keep accurate observations and have legal issues handled by a competent person, without converting the acceptance testing into a certificate.
Sources
- Cookies et traceurs : que dit la loi ? | CNIL (accessed 2026-10-08)
- Consent mode overview | Tag Platform | Google for Developers (accessed 2026-10-08)
