Cookies and Consent Mode: audit storage before and after consent

seoreport.ro loads the final URL in an isolated desktop browser with a clean state. It combines Set-Cookie headers with cookies visible after rendering, classifies recognizable names, and looks for consent interfaces, common CMP providers, Google tags, and detectable consent default or update calls.

The result is a snapshot of one URL, locale, device profile, and moment. A banner may vary by geography, path, login state, experiment, browser privacy settings, or prior consent, so an absent signal is a reason to investigate rather than proof that no implementation exists.

• Necessary Storage required for a requested function, such as security, session continuity, or load balancing. Confirm the actual purpose instead of relying only on the cookie name.
• Analytics and marketing Recognizable measurement, attribution, advertising, or profiling storage that commonly requires consent in many contexts.
• Unknown A cookie the heuristic cannot classify reliably. Trace its owner, value changes, expiry, and triggering request manually.

Cookie attributes define when the browser stores and sends a value. A correct combination depends on whether the cookie is host-only or shared with subdomains, server-only or intentionally available to JavaScript, same-site or cross-site, short-lived or persistent.

• Secure Restricts transmission to HTTPS requests, except special localhost handling. Use it for production cookies carried over secure origins.
• HttpOnly Prevents JavaScript access through document.cookie and helps reduce exposure of sensitive cookies during an XSS attack.
• SameSite Controls cross-site sending. SameSite=None permits cross-site use and must be paired with Secure in supporting browsers.
• Domain and Path Control where a cookie is sent; Path is routing scope, not an access-control mechanism. Omit Domain when subdomain sharing is unnecessary.
• Expires and Max-Age Define persistence. Use the shortest lifetime compatible with the stated function and verify deletion when consent is withdrawn.

Consent Mode changes how Google tags behave based on consent state. The core storage types are ad_storage and analytics_storage; Consent Mode v2 also includes ad_user_data and ad_personalization for advertising user data and personalized advertising.

Set defaults before any tag can use consent, then send an update as soon as the consent platform resolves the visitor’s choice. Google’s guidance also distinguishes basic implementations, where tags are blocked until interaction, from advanced implementations, where tags load with denied defaults and send cookieless signals where supported.

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  wait_for_update: 500
});

// After the visitor makes a choice:
gtag('consent', 'update', {
  analytics_storage: 'granted',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied'
});

If analytics or marketing cookies appear before a choice, identify the request that created them and the tag, plugin, embed, or server response that initiated it. A visually correct banner does not help when a container fires first or when a server writes non-essential storage independently.

When Google tags are present but defaults are missing, move consent initialization earlier than the tag loader. When defaults exist but updates do not, inspect the CMP callback and verify that accept, reject, and granular choices all send the expected values.

• Network Preserve the log, reload with storage cleared, and trace Set-Cookie responses and tag requests before interaction.
• Application Check server middleware, CMS plugins, tag-manager triggers, embedded media, chat, A/B testing, and analytics SDK initialization.
• Consent state Validate the initial default, the update event, persistence of the choice, withdrawal, and behavior on the next page view.

Test a fresh visitor before interaction, reject all, accept all, each granular combination, and withdrawal. Repeat on important templates and both supported languages. Confirm storage and network behavior—not only the banner text or the CMP dashboard.

Use Google Tag Assistant for Google consent diagnostics, browser DevTools for cookies and network requests, and the SEO report for a repeatable external snapshot. Recheck after tag-manager publishes, CMP changes, plugin updates, and CDN cache purges.