How to Test If Your CMP Actually Enforces Consent

Whether a Visitor Uses GPC or Declines Manually

A visitor clicks Reject All on your website. The banner closes, and your consent management platform records the selection. Another visitor arrives with Global Privacy Control, or GPC, enabled in their browser.

How do you know your website respects either choice?

To test whether your CMP actually enforces consent, compare the visitor’s privacy preference with what your website collects and sends. Check manual rejection and GPC separately, follow the visitor across pages and interactions, and verify that restricted activity stops or changes as intended.

A functioning banner is a starting point. The evidence is in the website’s behavior.

Whatever CMP you use, verify the implementation

Whether you use OneTrust, TrustArc, Usercentrics, Cookiebot, Didomi, Osano, Sourcepoint, CookieYes, Consentmo, Ketch, Axeptio, or another CMP, you should test the complete implementation.

These platforms offer different capabilities and configuration options. But your website also includes tag manager rules, directly embedded scripts, integrations, and technologies loaded by other scripts. Testing must cover how these components work together.

IAPP’s guidance on sustainable cookie programs recommends checking whether the reject-all button actually blocks the cookies it should. It also notes that website updates and software issues can disrupt an implementation.[1]



The practical question is straightforward: Does the website’s actual behavior match the visitor’s choice?

First define what should happen

Before testing, establish which technologies should be blocked or restricted under each privacy state. Otherwise, you will have a list of requests without a reliable way to decide whether they should have occurred.

Work with your privacy, marketing, and development teams to identify each technology’s purpose, the data it collects, its recipients, and the rules that apply. Consider visitor location, applicable requirements, and the promises in your privacy notice.

Keep manual rejection and GPC distinct. Clicking Reject All may reject several optional cookie categories. GPC communicates an opt-out relating to sale or sharing of personal information and, under relevant state laws, targeted advertising. It does not automatically mean that every nonessential cookie must be disabled.[2][3]

Your test should evaluate each choice against the restrictions it is supposed to produce.

Test a visitor who uses GPC

Use a browser or extension that supports GPC and verify that it is sending the signal. A privacy feature or tracking blocker is not, by itself, proof that GPC is enabled.

Start with a clean profile and visit your website without clicking the banner. Check whether the applicable restrictions take effect automatically. Continue navigating and repeat the relevant interactions from your manual test.

Where your business is required to honor GPC, the visitor should not need to click a separate manual opt-out to make the signal effective.[2][4]

Be careful about browser protections during this test. A browser or extension may block a tracker independently of your CMP. Record those protections and distinguish requests blocked by the browser from activity restricted by your implementation.

Also test a returning visitor who previously accepted cookies and then enables GPC. Check how your implementation handles the new signal rather than assuming the earlier saved preference settles the matter.



The importance of this verification is reflected in the Sephora enforcement case. Crowell & Moring’s analysis describes allegations that enabling GPC had no effect while data continued flowing to third parties. The 2022 settlement included a $1.2 million penalty.[4]

Look beyond cookies to the data being sent

A cookie inventory is useful, but it does not show every transmission. Review network requests to understand their destinations and contents.

Look at URL parameters, request payloads, and identifiers. Check whether page URLs, form information, or other data are being sent under a privacy state that should restrict that activity.

Include scripts embedded directly in your site and technologies loaded by other tags. For server-side tracking, review the backend’s consent handling and forwarding separately. Browser inspection can show a request leaving the browser; it cannot establish everything a server subsequently sends onward.

There is also an important distinction between blocking a tag and modifying its behavior. Google documents that advanced Consent Mode can send measurements without cookies while consent is denied.[5]

That means a request after rejection is a finding to investigate, rather than automatic proof of a violation. Equally, the absence of cookies does not establish that every transmission is permitted. Evaluate the data, purpose, recipients, and restrictions that apply.

Test returning visitors and complete journeys

A homepage test covers one moment in one journey. Expand your testing to include saved preferences, changes in choices, and authenticated experiences

Repeat the important scenarios across browsers, mobile devices, page types, regional configurations, and subdomains.



Choose journeys that exercise your tracking setup: product browsing, account access, checkout, video playback, and form completion, where applicable. These tests help you evaluate activity that a simple landing-page check would miss.

Keep evidence and verify again after changes

For each test, record the page, browser, region, privacy state, and timestamps. Document the expected behavior and the requests you observed. Keep enough detail for the implementation team to reproduce the finding.

When something does not match expectations, assign an owner, investigate, make the change, and repeat the same test.

Verification should continue as your website changes. IAPP recommends testing at implementation and maintaining a regular cadence for testing and audits.[1] In practice, retesting after tag changes, website releases,

CMP updates, and new integrations helps you check whether those changes affected enforcement.

Controlled tests and continuous monitoring can complement each other. Tests let you reproduce specific scenarios. Monitoring live traffic can help identify issues across additional visitor journeys and interactions.

Verify the choice through actual website behavior

The question is whether the visitor’s choice changes the collection and sharing it is supposed to control.

Test manual rejection. Test GPC. Test returning visitors. Inspect the data being sent, keep evidence, and verify again as your website evolves. There can be numerous combinations across geographies, browsers and device types. 

That’s why we created Sentinel Insights to take a manually and time extensive task and automate the findings.

Sentinel Insights helps teams monitor real-user traffic for potential consent and privacy issues, giving privacy, marketing, and development teams visibility into whether website activity follows visitor choices.

Sources and excerpts

[1] Jodi Daniels, IAPP — A comprehensive guide to creating a sustainable cookie program, May 1, 2024.

“It is essential you test systems at the onset and set a cadence for regular testing and holistic cookie audits.”

Contributed practitioner guidance covering governance, implementation testing, and ongoing audits.

[2] Alexander Proctor, IAPP — There’s no opting-out of universal opt-outs, July 2, 2025.

“the GPC is widely recognized as a mechanism for users to communicate a ‘Do Not Sell or Share’ preference.”

Contributed analysis explaining automated opt-outs and their relationship to website tracking.

[3] Global Privacy Control — Official GPC website.

“The GPC signal is intended to communicate a Do Not Sell or Share request”

Primary information about the signal’s intended meaning, supported tools, and specification.

[4] Crowell & Moring — $1.2 Million CCPA Settlement with Sephora Focuses on Sale of Personal Information and Global Privacy Controls, September 13, 2022.

“activating the GPC signal had no effect”

Legal analysis describing the allegations and settlement in the Sephora case.

[5] Google for Developers — Consent mode overview.

“When consent is denied, consent state and measurements without cookies are sent.”

Technical documentation describing product behavior. It does not establish whether a particular implementation satisfies applicable legal requirements.