The consent-first implementation checklist

Work through this in order. Most campaign sites fail at step three.

1. Inventory every tag on the site

Open the network tab on a fresh private window and list every third-party request the site makes before you touch anything. Analytics, ad pixels, chat widgets, heatmaps, embedded video, fonts, map embeds. Write them all down. Most teams find two or three they did not know were there.

2. Classify each one

For each tag: strictly necessary, functional, statistics, or marketing. Be honest — an ad pixel is marketing no matter which department installed it.

3. Set consent defaults to denied, in the head, before anything else

An inline script in the document head that sets all four Google Consent Mode v2 signals — ad_storage, analytics_storage, ad_user_data, ad_personalization — to denied, placed above every other tag. This is the step that fails most often, usually because a tag manager loads before the defaults script.

4. Install a consent management platform that actually blocks

A banner that records a preference without preventing scripts from running is decoration. Verify the blocking, do not assume it.

5. Verify with the network tab

Private window, decline consent, reload, watch the requests. Anything that fires is a finding. Repeat after every site change — this regresses constantly.

6. Verify the accept path

Accept consent and confirm the tags you expect now load, and only those.

7. Verify withdrawal

Withdraw consent and confirm activity stops without a page reload if your CMP supports it, and certainly on the next page load.

8. Version your consent language

Give the language a version string and store it with each consent. When the language changes, the version changes, and old records keep the terms they actually agreed to.

9. Record the source URL

Store the exact page URL where consent was captured, not just the domain. This is the field that answers “where did this come from” two years later.

10. Separate SMS consent

Consent to analytics is not consent to text. If you intend to text, collect that consent explicitly, with express written consent language, and store it as its own field. See TCPA & texting.

11. Check every subdomain and every landing page

Consent does not travel across domains. Your donate subdomain and your ad landing pages each need their own correct implementation.

12. Check your embeds

YouTube, maps, forms and chat widgets frequently set cookies on load. Either gate them or use privacy-preserving embed modes.

13. Document the retention schedule

How long do you keep supporter data, and what happens at the end? Write it down before somebody asks.

14. Test on mobile

Banner behavior on small screens is where accessibility and blocking bugs hide. Test keyboard navigation too.

15. Re-run this quarterly

Sites drift. A tag added in a hurry in September undoes an afternoon of work from March.