Cookie consent and Google Analytics in Ireland: what has to happen before the tag fires

A cookie banner and a working consent mechanism are separate things. To check a site designed to block Google Analytics until acceptance, inspect what the browser stores and which requests it attempts. The absence of a _ga cookie is useful evidence, but it does not prove that no data was sent.

Know which behaviour you intend

The Irish DPC explains that consent is normally required for cookies and similar tracking, with limited exemptions. Review the services your site uses and the choice presented to visitors.

Google distinguishes basic Consent Mode, which blocks tags until consent, from advanced Consent Mode, which can send cookieless measurements while consent is denied. Consequently, inspecting cookies alone cannot distinguish all data flows. See Google's Consent Mode documentation. A technical configuration is not, by itself, a legal assessment.

Test four separate states

1. No choice. Open a fresh browser profile. Open Developer Tools before loading the site, enable the network log and inspect cookies and other storage. Record requests to analytics services before touching the banner.
2. Reject. Start another fresh session, reject optional analytics and reload. For a block-until-consent implementation, analytics tags and collection requests should remain blocked.
3. Accept. Start fresh again and accept analytics. Check that the intended tag loads and that the change is reflected in storage and requests. Browser extensions or network filtering can prevent loading even when the site is configured correctly.
4. Withdraw. Reopen cookie settings after acceptance and withdraw analytics consent. Check subsequent navigation and reloads, the saved preference and the handling of existing cookies.

Use a test analytics property or a controlled interception setup when testing acceptance so artificial activity does not enter production reports. Record the URL, time, browser and network conditions with the result.

Interpret the evidence carefully

An analytics cookie created before any choice in a fresh profile needs investigation. An empty cookie list is not a clean bill of health: inspect network traffic too. A request blocked by an extension still shows that the page attempted to send it. And a cookie created after acceptance does not show that the rejection or withdrawal paths work.

Look for tags loaded through templates, plugins, tag managers and embedded third-party content. A second installation can bypass an otherwise correct consent gate. Retest the delivered public page after changes to caching, templates or integrations.

Make the result reproducible

Save a short report for each state: expected behaviour, observed storage, attempted requests and the remaining uncertainty. Keep personal data and identifiers out of shared screenshots or logs. Treat this as one part of a wider review covering the notice, consent choice, data destinations and retention.

The CJM Bathrooms case study documents a project where analytics loading was connected to the banner's analytics category. The same acceptance, rejection and withdrawal checks should be repeated when that implementation changes.