Independently verify Cookiebot in South Africa

The South Africa test

Tie the browser test to the team's declared processing purposes. Map optional tools to the purposes and choices approved for the South African visitor. Compare the local rule with the fallback and inspect what changes after refusal. A banner cannot establish the lawfulness of all processing.

Set expected behavior with your policy owner before testing. Business scope, data purposes, and exceptions affect that expectation. Use the South African Information Regulator: lawful processing as a policy reference; this procedure checks browser behavior and does not certify legal compliance.

CookieTrail does not currently offer a South Africa country route. Use a separately verified regional browser exit for this procedure.

Run the same paths from a verified visitor

1. Confirm routing. Record the browser exit and the regional rule Cookiebot actually selected. Browser language, timezone, and a DevTools location override are not proof of IP-based routing.
2. Start clean. Use separate new sessions for first load, acceptance, and rejection or opt-out. Begin storage and network capture before page load; record the capture window and deployed version.
3. Read the decision. Save the banner controls used, the category or purpose values, and any Consent Mode mapping. Use this installation’s documented readback.
4. Compare and repeat. Compare observed tools with the expected policy, investigate a mismatch, and rerun the same URL, regional rule, and paths after deployment.

Read Cookiebot’s saved state

Compare the deployed Cookiebot configuration with the browser's category flags.

1. Record the deployed domain-group ID (data-cbid) and any regional configuration mapping. Compare it with the configuration you intended to publish.
2. After Cookiebot loads, read hasResponse and the preferences, statistics, and marketing consent flags. Record the first load and each choice separately.
3. If you use automatic blocking, inspect the blocking configuration; for manual blocking, inspect each script's category. Compare both with actual storage and requests.

Read the Cookiebot developer API for your installed configuration.

(() => {
  const c = window.Cookiebot;
  if (!c) return { status: "not ready or unavailable" };
  return {
    hasResponse: c.hasResponse,
    preferences: c.consent?.preferences,
    statistics: c.consent?.statistics,
    marketing: c.consent?.marketing,
    gdprApplies: c.regulations?.gdprApplies
  };
})()

(() => {
  if (typeof window.__tcfapi !== "function")
    return { status: "TCF unavailable or disabled" };
  window.__tcfapi("addEventListener", 2, (data, ok) => {
    if (!ok || !data ||
        !["tcloaded", "useractioncomplete"].includes(data.eventStatus))
      return;
    console.log({
      cmpId: data.cmpId,
      expectedCmpId: 134,
      identityMatches: data.cmpId === 134,
      cmpStatus: data.cmpStatus,
      eventStatus: data.eventStatus,
      gdprApplies: data.gdprApplies,
      purposeConsents: data.purpose?.consents,
      purposeLegitimateInterests: data.purpose?.legitimateInterests
    });
    window.__tcfapi("removeEventListener", 2,
      () => {}, data.listenerId);
  });
})()

Compare state with observed activity

A saved denial can coexist with a tag that ran too early or never received the update. Trace the affected integration and its event timing. A network request alone does not prove a violation: Google’s advanced Consent Mode can send cookieless requests.

Unreadable state, unverified routing, or a missing capture makes the result inconclusive. Browser captures also cannot establish what a server-side integration does. Keep that investigation separate and compare evidence after the fix.