Skip to content
CookieTrail
Run free audit
Menu

CMP verification

Verify Cookiebot by country and state

Check the Cookiebot configuration visitors actually receive, the choice it saves, and what your tags do with that choice. Choose a location below for the regional check, routing requirements, and a reusable worksheet.

Interactive example · no site is scanned

A saved rejection can still leave a tag running

Example policy: optional analytics must stay off after refusal. Change the evidence for a Cookiebot visitor in Germany and see what you can conclude. These values are teaching fixtures.

01 · REGIONGermanyIntended rule: de
02 · SAVED CHOICEOptional analytics: deniedCookiebot readback after the example refusal.
03 · BROWSER ACTIVITYOptional analytics cookie appearsExample capture window: 10 seconds after the choice. Server-side processing is outside this fixture.
Change the example evidence
Investigate the mismatch

The saved choice is readable, but observed activity conflicts with the example policy. Trace the affected integration and retest after deployment.

Build your repeatable test plan

Test scope

6 worksheet rows. First load, acceptance, and refusal each use fresh sessions. The worksheet records actual region, selected rule, expected policy, saved state, and observed activity.

Read the generated test plan
Independently verify Cookiebot on https://example.com for a visitor in Germany.
CookieTrail offers a Germany country route (de). Confirm the CMP's selected rule in the evidence before interpreting the result.
Trace the first tag before the banner is clicked. Start a new browser session and compare the first nonessential cookie or request with the time the consent defaults were set. A German banner can appear after a tag has already run.

Run these paths: first load, accept optional categories, reject / opt out. Use fresh isolated sessions for first load, accept, and reject; withdrawal uses its own earlier acceptance. Record the URL, deployed version, actual visitor region, selected CMP rule, expected policy, saved state, cookies, requests, and capture window. Use the installed CMP's documented readback; missing data is inconclusive. Do not equate a TCF applicability flag or a banner language with geography.

Compare saved choices with observed behavior against the team's stated policy. A request alone does not establish a violation; Google advanced Consent Mode may send cookieless requests. Do not assume browser evidence covers server-side tracking. Investigate mismatches in my repository and explain each finding with evidence. After I deploy a fix, repeat the same URL, regional rule, and paths, then compare both evidence sets.

CookieTrail can capture its supported country routes through its workspace/API/MCP. State/province routing, browser preference signals, and withdrawal require separate verified manual or external browser tests; do not claim those are built-in automated paths. This is a technical test, not legal certification.

Country-route capture is available for CookieTrail’s supported locations. Precise state/province routing, withdrawal, and browser preference signals need separate manual or external tests.

Read Cookiebot’s saved state

Compare the deployed Cookiebot configuration with the browser's category flags.

  1. Record the deployed domain-group ID (data-cbid) and any regional configuration mapping. Compare it with the configuration you intended to publish.
  2. After Cookiebot loads, read hasResponse and the preferences, statistics, and marketing consent flags. Record the first load and each choice separately.
  3. If you use automatic blocking, inspect the blocking configuration; for manual blocking, inspect each script's category. Compare both with actual storage and requests.

Read the Cookiebot developer API for your installed configuration.

Read-only native snapshot

Run this in the tested page’s browser console after initialization, before the choice and after each path. It reads state; it does not grant or reset consent.

(() => {
  const c = window.Cookiebot;
  if (!c) return { status: "not ready or unavailable" };
  return {
    hasResponse: c.hasResponse,
    preferences: c.consent?.preferences,
    statistics: c.consent?.statistics,
    marketing: c.consent?.marketing,
    gdprApplies: c.regulations?.gdprApplies
  };
})()
Optional TCF identity and purpose snapshot · CMP ID 134

Use this only when TCF is enabled. Run it again after each decision. The CMP ID identifies the platform; it is not an advertising vendor ID. Compare purpose and vendor permissions separately.

(() => {
  if (typeof window.__tcfapi !== "function")
    return { status: "TCF unavailable or disabled" };
  window.__tcfapi("addEventListener", 2, (data, ok) => {
    if (!ok || !data ||
        !["tcloaded", "useractioncomplete"].includes(data.eventStatus))
      return;
    console.log({
      cmpId: data.cmpId,
      expectedCmpId: 134,
      identityMatches: data.cmpId === 134,
      cmpStatus: data.cmpStatus,
      eventStatus: data.eventStatus,
      gdprApplies: data.gdprApplies,
      purposeConsents: data.purpose?.consents,
      purposeLegitimateInterests: data.purpose?.legitimateInterests
    });
    window.__tcfapi("removeEventListener", 2,
      () => {}, data.listenerId);
  });
})()

A TCF applicability flag does not verify geography. Legitimate-interest fields and consent fields have different meanings; rejection does not imply every field becomes false. This uses the documented TCF event API; getTCData is deprecated.

These procedures use documented readbacks or manual saved-state checks. They do not imply that CookieTrail has an automated native adapter for every installation. Cookiebot is identified in Google’s referenced CMP inventory or partner list.

Choose a visitor location