Skip to content
CookieTrail
Run free audit
Menu

state verification

Verify cookie consent in California

Test sale/share opt-out and browser preference signals separately from cookie rejection. Run a fresh visit with Global Privacy Control off, then another with it on. Inspect your sale/share mapping and downstream advertising state. A saved analytics denial alone doesn't verify a sale/share opt-out.

Routing and expected behavior

CookieTrail does not currently offer a verified California state route. Use a separately verified California browser exit for this procedure; US East or US West alone is insufficient.

Have the policy owner establish business scope, purposes, and any applicable exceptions using the California Privacy Protection Agency: CCPA questions. Then test the configuration actually served in the browser. A country label, translated banner, or configured dashboard preview does not establish the selected visitor rule.

Interactive example · no site is scanned

A saved rejection can still leave a tag running

Example policy: optional analytics must stay off after refusal. Change the evidence for a Osano visitor in California and see what you can conclude. These values are teaching fixtures.

01 · REGIONRegional rule unverifiedAn exit location alone does not prove the CMP selected us-ca.
02 · SAVED CHOICEOptional analytics: deniedOsano readback after the example refusal.
03 · BROWSER ACTIVITYOptional analytics cookie appearsExample capture window: 10 seconds after the choice. Server-side processing is outside this fixture.
Change the example evidence
Evidence incomplete

Verify the visitor region and selected CMP rule before judging this regional result.

Build your repeatable test plan

Test scope

6 worksheet rows. First load, acceptance, and refusal each use fresh sessions. The worksheet records actual region, selected rule, expected policy, saved state, and observed activity.

Read the generated test plan
Independently verify Osano on https://example.com for a visitor in California.
CookieTrail does not currently offer a verified California state route. Use a separately verified California browser exit for this procedure; US East or US West alone is insufficient.
Test sale/share opt-out and browser preference signals separately from cookie rejection. Run a fresh visit with Global Privacy Control off, then another with it on. Inspect your sale/share mapping and downstream advertising state. A saved analytics denial alone doesn't verify a sale/share opt-out.

Run these paths: first load, accept optional categories, reject / opt out. Use fresh isolated sessions for first load, accept, and reject; withdrawal uses its own earlier acceptance. Record the URL, deployed version, actual visitor region, selected CMP rule, expected policy, saved state, cookies, requests, and capture window. Use the installed CMP's documented readback; missing data is inconclusive. Do not equate a TCF applicability flag or a banner language with geography.

Compare saved choices with observed behavior against the team's stated policy. A request alone does not establish a violation; Google advanced Consent Mode may send cookieless requests. Do not assume browser evidence covers server-side tracking. Investigate mismatches in my repository and explain each finding with evidence. After I deploy a fix, repeat the same URL, regional rule, and paths, then compare both evidence sets.

CookieTrail can capture its supported country routes through its workspace/API/MCP. State/province routing, browser preference signals, and withdrawal require separate verified manual or external browser tests; do not claim those are built-in automated paths. This is a technical test, not legal certification.

Country-route capture is available for CookieTrail’s supported locations. Precise state/province routing, withdrawal, and browser preference signals need separate manual or external tests.

Choose the CMP installed on your site