Independently verify Usercentrics in Colorado

The Colorado test

Check the universal opt-out path independently of the banner buttons. Record the browser signal, the CMP's selected Colorado rule, and the corresponding advertising permissions. Keep ordinary reject-button results separate so a working button cannot mask an ignored signal.

Set expected behavior with your policy owner before testing. Business scope, data purposes, and exceptions affect that expectation. Use the Colorado Attorney General: Colorado Privacy Act as a policy reference; this procedure checks browser behavior and does not certify legal compliance.

CookieTrail does not currently offer a verified Colorado state route. Use a separately verified Colorado browser exit for this procedure; US East or US West alone is insufficient.

Run the same paths from a verified visitor

1. Confirm routing. Record the browser exit and the regional rule Usercentrics actually selected. Browser language, timezone, and a DevTools location override are not proof of IP-based routing.
2. Start clean. Use separate new sessions for first load, acceptance, and rejection or opt-out. Begin storage and network capture before page load; record the capture window and deployed version.
3. Read the decision. Save the banner controls used, the category or purpose values, and any Consent Mode mapping. Use this installation’s documented readback.
4. Compare and repeat. Compare observed tools with the expected policy, investigate a mismatch, and rerun the same URL, regional rule, and paths after deployment.

For this state, add separate browser preference-signal tests where your approved policy calls for them. Record the signal and resulting advertising permissions. A signal-on visit is a different test from clicking Reject; this guide does not assume every state has identical signal requirements.

Read Usercentrics’s saved state

Check both the ruleset and configuration-level geo-targeting.

1. Record the deployed settings ID and the regional ruleset it uses.
2. Inspect both the ruleset and the configuration's geo-targeting. Usercentrics documents cases where an EU-only selection excludes the UK or Switzerland.
3. Read the saved service choices using the documented API for your installed product and version, or the preferences panel. Compare each service with its tag behavior.

Read the Usercentrics: regional banner configuration for your installed configuration.

(() => {
  if (typeof window.__tcfapi !== "function")
    return { status: "TCF unavailable or disabled" };
  window.__tcfapi("addEventListener", 2, (data, ok) => {
    if (!ok || !data ||
        !["tcloaded", "useractioncomplete"].includes(data.eventStatus))
      return;
    console.log({
      cmpId: data.cmpId,
      expectedCmpId: 5,
      identityMatches: data.cmpId === 5,
      cmpStatus: data.cmpStatus,
      eventStatus: data.eventStatus,
      gdprApplies: data.gdprApplies,
      purposeConsents: data.purpose?.consents,
      purposeLegitimateInterests: data.purpose?.legitimateInterests
    });
    window.__tcfapi("removeEventListener", 2,
      () => {}, data.listenerId);
  });
})()

Compare state with observed activity

A saved denial can coexist with a tag that ran too early or never received the update. Trace the affected integration and its event timing. A network request alone does not prove a violation: Google’s advanced Consent Mode can send cookieless requests.

Unreadable state, unverified routing, or a missing capture makes the result inconclusive. Browser captures also cannot establish what a server-side integration does. Keep that investigation separate and compare evidence after the fix.