How to Audit Your Website Tags Before Installing a Cookie Banner

How to Audit Your Website Tags Before Installing a Cookie Banner

A cookie banner should not be the first thing you add to a website. It should be the visible part of a bigger consent setup. Before you ask visitors to accept or reject cookies, you need to know what your website is actually loading.

Many websites have more tracking scripts than the owner realises. Some come from Google Analytics, Google Ads, Meta Pixel, LinkedIn Insight Tag, live chat tools, heatmap tools, embedded videos, affiliate platforms, or old campaigns. Others sit inside Google Tag Manager and are forgotten for years.

That is why a website tag audit matters.

A tag audit helps you understand which scripts, pixels, cookies, and third-party tools are active on your site. It shows which tools are necessary, which need consent, which should be blocked before consent, and which should be removed.

In this guide, we cover:

• What a website tag is
• Why you should audit before adding a cookie banner
• How to list, check, scan, and categorise your tags
• How to connect the audit to your CMP setup

---

What is a Website Tag?

A website tag is a piece of code that runs on your website to collect information, trigger a tool, or send data to another platform.

Common examples include Google Analytics 4, Google Ads conversion tracking, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, Microsoft Advertising UET tag, heatmap tools, A/B testing tools, live chat widgets, CRM tracking scripts, affiliate tracking scripts, and embedded video players.

Some tags are installed directly in your website code. Some are added through Google Tag Manager. Some are added by plugins, themes, app stores, page builders, agencies, or developers.

That is why a visual check is not enough. A website can look clean from the outside and still load dozens of scripts in the background.

---

Why Audit Tags Before Adding a Cookie Banner?

A cookie banner only works properly when it is connected to the real tracking behaviour of your website.

The UK Information Commissioner's Office explains that cookies and similar technologies can require clear user information and consent, especially when they are not strictly necessary for the service requested by the user. This includes similar technologies, not only files called cookies.

A tag audit helps you answer important questions: what scripts are loading, which vendors receive data, which cookies are being set, which tags fire before consent, which tags fire after reject, which tools are no longer needed, and which tags should be classed as analytics, marketing, preferences, or necessary.

Without this information, your cookie banner text is just a guess.

---

Step 1: List Your Known Tools

Start by listing every tool you believe is installed on the website.

Speak to the people who may have added scripts in the past, including marketing, paid ads, SEO, developers, agencies, CRM owners, support teams, and ecommerce managers.

Create a simple spreadsheet with columns for tool name, vendor, purpose, installed location, owner, keep or remove decision, and consent category. For example, Google Analytics may sit under analytics, Meta Pixel under marketing, and a live chat tool under functional.

This list will not be perfect at first. The goal is to create a starting point before you test the live site.

---

Step 2: Check Google Tag Manager

If the website uses Google Tag Manager, review the container carefully.

Google Tag Manager lets teams manage tags without changing website code every time. But it can become messy when many people have had access over time.

Inside your container, check for active and paused tags, custom HTML tags, page view and click triggers, form submission triggers, conversion tags, remarketing tags, consent settings, duplicate GA4 or Google Ads tags, unclear tag names, and old campaign tags.

Pay special attention to Custom HTML tags. These can contain almost any script, including third-party tracking code. A tag called "Homepage script" may not tell you much, so open it and check what it actually does.

---

Step 3: Scan Your Live Website

Manual checks are useful, but they will not catch everything. You also need to scan the live website.

A cookie scanner helps identify cookies and tracking technologies that appear when pages load.

Do not only check the homepage. Important tags often appear on deeper pages, such as pricing pages, product pages, contact pages, checkout pages, booking pages, thank-you pages, login pages, and ad landing pages.

If your website has different templates, scan examples from each template. Ecommerce, SaaS, lead generation, and membership websites often have different tags on different page types.

---

Step 4: Test What Loads Before Consent

This is the most important part of the audit.

Open the site in a clean browser session. Before clicking anything on the banner, check what has already loaded. Look for cookies, local storage, session storage, network requests to analytics or advertising platforms, tracking pixels, chat widgets, heatmap tools, and embedded media scripts.

If non-essential analytics or marketing tools load before the user makes a choice, the banner is not controlling consent correctly.

---

Step 5: Test Reject, Accept, and Partial Consent

Do not only test the accept button.

You need to test before consent, after reject all, and after accept all. If your banner allows category-level choices, test those too. For example, accept analytics but reject marketing, then check whether marketing pixels stay blocked.

For Google tags, use Google Tag Assistant to inspect which tags are firing and how consent signals behave. If you use Google Consent Mode, review the official setup guide.

---

Step 6: Categorise Every Tag

Once you know what is active, classify every tag into a consent category.

Strictly Necessary. These are needed for the website to work. Examples may include security, session management, basket functionality, and login authentication. Be strict with this category. A tag is not strictly necessary just because it is useful for marketing.

Preferences. These remember choices such as language, region, display settings, or saved preferences.

Analytics. These measure how visitors use the website. Examples include page views, traffic sources, button clicks, and conversion paths.

Marketing. These support advertising, retargeting, conversion measurement, lookalike audiences, and campaign attribution.

Functional. These support extra features such as live chat, embedded videos, booking widgets, maps, or support tools.

Your categories should match what your cookie banner shows to users. If your banner says "marketing cookies," every marketing tag should be controlled by that choice.

---

Step 7: Remove Tags You Do Not Need

A tag audit often reveals old tools that no one owns anymore.

Remove tags that are duplicated, unused, from old agencies, from expired campaigns, sending data to unknown vendors, slowing down the website, missing from your privacy policy, or not clearly linked to a business purpose.

---

Step 8: Connect the Audit to Your Cookie Banner

After the audit, your CMP setup should reflect the real website.

This means necessary tags load without consent only when truly necessary, analytics tags wait for analytics consent, marketing tags wait for marketing consent, rejected users are not tracked by non-essential tools, and the cookie policy matches the actual scan results.

You should also update your privacy policy and cookie policy. Users should be told what tools are used, what they do, who provides them, and how long cookies last.

---

How CookiePal.io Helps

CookiePal.io is designed to make website tag management and consent compliance easier:

• Cookie Scanning - Automatically detect all cookies and tracking technologies on your site
• Auto-Categorisation - Intelligently classify tags by type (analytics, marketing, functional, etc.)
• Auto-Blocking - Prevent non-essential tags from firing until users grant consent
• Google Consent Mode - Full support for Google's consent framework
• Scheduled Scanning - Run regular audits to catch new tags automatically
• Audit Reports - Generate detailed reports of your website's tag inventory

---

Website Tag Audit Checklist

Before installing or updating your cookie banner, check the following:

• You have listed known analytics, marketing, and support tools
• You have reviewed Google Tag Manager
• You have scanned important page types
• You have tested before consent, reject all, and accept all
• You have tested category-level choices
• You have checked cookies, local storage, and network requests
• You have removed unused or unknown tags
• You have categorised every remaining tag
• You have mapped tags to banner categories
• You have checked Google Consent Mode if using Google tags
• You have updated your cookie policy

---

Final takeaway

A cookie banner should reflect what your website actually does. If you do not audit your tags first, you may give users choices that do not work, miss hidden scripts, or leave old tracking pixels active.

A website tag audit helps you remove unnecessary scripts, understand which tools need consent, configure your CMP properly, and reduce privacy risk.

Before asking visitors to accept cookies, make sure you know exactly what they are being asked to accept.