How do I check what my website sends before a visitor consents?

I’m a marketer, not a lawyer, and nothing here is legal advice. Last verified October 27, 2026; changes are logged at the end of this page and in the library’s change log. This test shows what your site sends and when. Whether any of it is a legal problem where you operate is a question for a licensed attorney in your state.

Your tag manager won’t show what your tags load

Website tracking complaints describe network traffic: which tag fired, on which page, what it carried, and whether it went out before the banner was answered or kept going after “Reject all.” Fisher Phillips tracked six September 2026 rulings, four for the companies sued, several turning on what the complaint said the site actually sent.

A tag manager lists what someone installed, and tags load other tags. When I logged what the Microsoft Ads tag loaded on 32 sites, it was the only thing on the page requesting Microsoft’s session recorder, Clarity, on 4 of them. A tag list wouldn’t show that. The browser’s network panel shows every request, so that’s where the test runs.

Set up

1. Open Chrome in an Incognito window, so there are no extensions and no cookies from earlier visits.
2. Open DevTools with F12 and go to the Network tab. Tick Preserve log and Disable cache.
3. Paste this into the filter box. Chrome treats text between slashes as a pattern:

/facebook|google-analytics|googletagmanager|googleadservices|doubleclick|pagead|\/collect|recaptcha|maps\.google|tiktok|linkedin|licdn|bat\.bing|clarity\.ms|hotjar|fullstory|mouseflow|luckyorange|crazyegg|intercom|livechat|drift|callrail|whatconverts|calltrackingmetrics|invoca|youtube|vimeo|pinterest|reddit|snap|nextdoor|ads-twitter/

/collect catches Google requests routed through your own domain, including Google tag gateway paths. Add any vendor your site uses that isn’t on the list.

Test 1: before any choice

Load your homepage, then the page a visitor would least want shared: a condition or treatment page, a practice-area page, or a booking form. Don’t touch the banner.

Every row that appears left the browser before the visitor chose anything. That can be by design: many US banners say tracking is on until the visitor opts out, and on those sites Test 2 and Test 3 are the ones that show whether the opt-out works. Sort the rows by the Type column. Script downloads (type script) fetch a tag’s code, which tells the vendor your visitor’s IP address and the site they’re on. The requests that carry the page and identifiers show up as ping, gif, xhr or fetch. Click a few and read the request URL and payload:

• The page. dl= on GA4 and Meta requests and url= on Google Ads requests is the page address. dt= is the page title. On /services/dui-defense/ the address alone names the subject.
• Identifiers. _fbp or fbp= (Meta’s browser cookie), cid= (Google Analytics’ client id), gclid (the ad click).
• Form data. ud[ on a Meta request is hashed customer data the site passes to Meta. udff[ shows up in practice when automatic advanced matching picks up fields on its own. Meta doesn’t document that name, so treat any ud[ or udff[ value as customer data. FTC technology staff wrote in July 2024 that hashing doesn’t make data anonymous.
• Replay. Any clarity.ms, hotjar or fullstory request means a session recorder is running.

Test 2: after Reject all

Open a fresh Incognito window, so cookies set in Test 1 don’t show up as new. Load a page, click Reject all (or “Do not sell or share”), clear the network log, and open two more pages. Any new Meta, TikTok or session-recorder request after that click, or any Google collect, pagead or doubleclick request carrying anything other than gcs=G100, means the banner recorded the choice without acting on it. Then check Application, Cookies for _fbp, _ttp, _gcl_au or _uetsid appearing after the rejection.

Test 3: Global Privacy Control

Global Privacy Control is a browser signal that says “don’t sell or share my data.” Haynes Boone counted 12 states, California and Colorado among them, whose laws require businesses to honor opt-out signals like this (July 2026). California’s privacy agency fined Tractor Supply $1.35 million on September 30, 2025, in a case that included opt-outs that didn’t work. Firefox sends it in every Private window by default (Mozilla). Firefox, Brave and DuckDuckGo all block some trackers on their own, so a quiet network panel there can prove nothing about your site. In Firefox, click the shield icon in the address bar and turn off Enhanced Tracking Protection for your site before testing. Firefox’s filter box takes the same pattern with regexp: in front instead of the slashes, and its Ctrl+F doesn’t search request contents, so use Chrome for Test 4.

In the browser, open the console and type navigator.globalPrivacyControl. It should return true (W3C explainer). Reload your site and repeat Test 1. If the site honors the signal, ad tags stay quiet or run in a restricted mode. Meta’s restricted mode shows as dpo=LDU on its requests, and Google’s can show as rdp=1 or npa=1. Google also applies restricted data processing on its own servers when it receives the signal in the states that require it (checked October 2026), so a missing rdp=1 doesn’t prove Google ignored it.

Test 4: a test word in your site search

Type a word nobody would search, like canarytest417, into your site’s search box and run the search. In the network panel press Ctrl+F (Cmd+F on a Mac), which searches headers, payloads and responses, not just addresses. Search for canarytest417. Any hit on a third-party host means your search terms go to that vendor. Site search bars became a target of these claims in 2024, followed by a wave of demand letters. The most common route is the results page address: if it reads ?s=canarytest417, every tag on that page received the term through dl=. GA4’s enhanced measurement also logs it as search_term.

Then do the same with your own contact form, using fake details like test+audit@example.com. Watch for the email, phone or service choice in any third-party request, and look at the thank-you page address. If it carries the form answers as query parameters, every tag on that page received them.

What the codes mean

Code	Where	Meaning
gcs=G100	Google requests	Ads and analytics storage denied
gcs=G111	Google requests	Both granted. Before any click, the default for this visitor’s region was granted
gcs=G1--	Google requests	No consent state reached the tag (or gcs is missing entirely)
gcd=	Google requests	The Consent Mode v2 state, including ad_user_data and ad_personalization, which gcs doesn’t show
asc=D / asc=G	Microsoft UET	Ad storage denied / granted
dpo=LDU	Meta	Limited Data Use, Meta’s restricted mode
rdp=1 / npa=1	Google	Restricted data processing / non-personalized ads

Google doesn’t publish the gcs and gcd codes. They’re read from the requests themselves.

A script download from googletagmanager.com isn’t data about the visitor’s activity. A collect or pagead request to Google before any click means the site runs Consent Mode in advanced mode, or no Consent Mode. In basic mode Google receives no measurement until the visitor chooses. The Consent Mode answer covers what those early requests contain, and Google’s consent debugging guide shows the same checks in Tag Assistant.

What this test can’t tell you

• Whether anything is unlawful. It shows behavior. The law is your attorney’s call.
• Server-side destinations. If your site sends data to its own server first, the browser only shows that hop. Ask whoever runs the server container for the list of destinations and a sample of what each one receives.
• What a vendor does afterward. It shows what leaves your site, not what the vendor keeps.
• Every visitor’s experience. One browser, one location, one visit. Banners often behave differently by state or on a second visit, which is how a consent bug I found hid from everyone who tested it on a first visit.

Save what you find. Export each test as a HAR file (the download arrow in the Network panel) along with a dated screenshot. The HAR keeps the payloads, and a screenshot doesn’t. Chrome’s default HAR leaves out cookie headers, so screenshot Application, Cookies too. That’s the record your attorney will want if a letter ever arrives. Run the tests again after any site, theme, plugin or tag change.

Common questions

How long does the whole test take?

About five minutes for the homepage and one sensitive page. Add a minute for each extra page you care about.

Do I need special software?

No. Chrome’s built-in DevTools does Tests 1, 2 and 4. Firefox in a Private window, with Enhanced Tracking Protection off for your site, covers Test 3.

What should I fix first if things fire early?

Start with the pages that name a condition, a legal matter or a booking. On a law firm’s practice-area and intake pages and a medical practice’s booking flow, that usually means removing tags.

Update log

• October 27, 2026 (later): Added the opt-out banner note to Test 1, the Firefox tracking-protection step, a sourced count of Global Privacy Control states, and a wider filter. Tightened the Test 2 rule and the Meta form-data note.
• October 27, 2026: Published.

When to bring me in

Bring me in when the Meta Pixel, Google tags or a session recorder fire before your banner is answered, when Reject all doesn’t stop them, or when nobody can say what each tag on the site is for.

I'm Conner Crowe, and I write every audit myself. Send the free audit request and add me as a read-only user, and within 24 hours of access you'll have a written read on what your account counts as a conversion, what your live site sends before consent, and what to fix first. No call needed, and nothing in your account or store changes.

Request a free Google Ads audit →

See how I fix conversion tracking.