PRIVATE · INITIAL-STATE PREVIEW
Consent Mode Audit Tool
Review retained consent declarations and limited GA4 network evidence. Keep observed commands separate from effective consent, post-choice behavior and legal compliance.
Browser worker: setup required
Automatic checks are not connected yet. A dedicated isolated browser worker must be deployed and verified. This implementation requires no paid API.
What is observed — and what is not
A bounded, read-only end-of-window data-layer snapshot and supported GA4 request-field presence. Queue positions are not a verified execution timeline. A gcd field can exist even without Consent Mode activation.
No banner button is clicked. Effective consent, regional applicability, cookie enforcement and behavior after grant, deny or revoke remain unverified.
Questions and limits
Does this verify Consent Mode works?
Not completely. The preview observes one no-interaction initial page load, retained commands in one data layer, and consent-field presence on two supported GA4 endpoints. Effective state, cookie enforcement and behavior after grant, deny or revoke remain unverified.
Does a gcd parameter mean Consent Mode is enabled?
No. Google documents that gcd may be sent regardless of activation. The report records presence only and does not decode wire fields into a consent verdict.
What if no default command is observed?
A custom or replaced queue, discarded commands, regional behavior or GTM template consent APIs can be invisible to this snapshot. Not observed does not mean missing or broken implementation.
Can queue order prove defaults ran before tags?
No. The read-only end-of-window snapshot preserves queue positions, not execution timestamps. It never wraps gtag or dataLayer.push. Network observations and command declarations must be reviewed separately.
Will this click my consent banner?
No. It does not accept, reject, revoke, submit forms or synthesize events. Initial page loading may naturally emit analytics. Use an authorized page, preferably a controlled test environment.
How are regions assessed?
Declared region codes are shown without resolving overlapping defaults or inferring the worker location. Country-specific, returning-visitor and post-choice scenarios require controlled tests.
What source setup is required?
A dedicated verified Playwright/Chromium worker is required. No paid API is needed by this implementation. Docker/container isolation and source acceptance must be tested before approval; a setup-ready page is not a live service.
What stays private?
Checks require your own signed-in session. The report excludes raw request values, cookies, client/session IDs and arbitrary data-layer fields. No report history is stored by this module. The submitted URL should still be reviewed before sharing downloads.
Is the browser identical to a normal visitor?
No. Network-none Chromium uses a public HTTPS IPv4 broker that omits cookies/auth headers, honors robots and blocks unsupported network behavior. Service workers are blocked. These restrictions may change results; cookie enforcement cannot be tested by this preview.
Does this certify legal compliance?
No. It provides technical observations and review prompts only, not a legal assessment, compliance score or basic/advanced mode certification.
Continue verification
Use controlled scenarios and Google's Tag Assistant guidance to review defaults, consent updates and tag behavior. This preview does not replace that process.