# The Consent Banner Audit: 7 Checks Before You Trust the Opt-In Rate

Source: https://bannerbulwark.com/blog/2026-11-12-consent-banner-audit-7-checks-opt-in-rate.html

November 12, 2026

*Audit the banner the way a regulator would: check that no tag fires before consent, that reject is as easy as accept, that the choice is recorded with proof, and that withdrawal works. The opt-in rate is the last number to look at, not the first.*

## The rate that lies

A store reports an 82% opt-in rate and treats it as a compliance result. It is not. It is a design result, and the design that produces it is usually the problem. A banner with no reject button on the first layer, a pre-ticked box, a reject link buried in a paragraph, and a bright accept button against a gray reject link will produce a high opt-in rate on any site, because it is not measuring consent. It is measuring friction. The European Data Protection Board has been explicit about this since its 2023 guidelines: consent that is not freely given is not valid consent, and a design that makes refusal harder than acceptance is not freely given.

The audit below is the one to run before quoting the rate to anyone. It takes an hour, it needs no tooling beyond a browser and the network tab, and it finds the failures that a CMP dashboard never reports, because the dashboard is measuring the banner's behavior, not the law's requirements.

## The seven checks

One, load the site with a clean profile and watch the network tab before touching the banner. If any analytics, advertising, or marketing tag fires before a choice, the banner is decoration. Google Consent Mode v2 in basic mode blocks the tags until consent; advanced mode loads them in a restricted, cookieless state. Either is defensible. Tags firing freely before consent is not. Two, count the clicks to reject. Accept is one click. Reject should be one click too, a button of the same size and shape, on the same layer. Three clicks to reject is a dark pattern, and the CNIL has fined for exactly that. Three, read the banner text. It should say what the site does with data, in the language the shopper reads, not in the language the lawyers wrote. Four, check the withdrawal path. GDPR Article 7(3) requires withdrawing consent to be as easy as giving it: a permanent, visible link or icon, not a settings page three clicks deep.

Five, open the consent record. The CMP should log the choice, the time, the banner version, and the purposes consented to, in a form that survives an audit. A record that says "accepted" with no timestamp and no version is a claim, not proof. Six, test the banner on mobile, where it most often covers the whole viewport and blocks the add-to-cart button. Seven, check the vendor list. A CMP with 800 vendors in its transparency list is not giving the shopper a choice; it is giving them a document. If the list is that long, the site is loading that many third parties, and the banner is the least of its problems.

## What to do with the result

Fix in the order above, because the order is the severity order. Tags firing before consent is a live violation, and it stops the moment the tag manager is configured correctly. Reject friction is a design fix measured in hours. The record and the withdrawal path are configuration, not development. The vendor list is a procurement conversation, and it is the one most teams avoid, because it means admitting how many third parties the site actually loads. Do it anyway. The opt-in rate that comes out of a banner that passes all seven checks is lower than the one that fails them, and it is the only one worth reporting, because it is the only one that measures consent. The load-order half of this audit is [your banner arriving after the tags already fired](https://bannerbulwark.com/blog/2026-11-11-consent-banner-load-order-tags-fired.md), and the checkout half is [the banner that cannot block the purchase](https://bannerbulwark.com/blog/2026-11-11-consent-banner-checkout-block-purchase.md).

## Frequently asked questions

### What is a good consent opt-in rate?

There is no good rate in isolation. A high rate from a banner with no first-layer reject measures friction, not consent. The rate only means something after the banner passes the checks: no tags before consent, one-click reject, a real record, and a working withdrawal path.

### How many clicks should rejecting take?

One, the same as accepting. The EDPB requires refusal to be as easy as acceptance, and the CNIL has fined publishers whose reject path took several clicks or hid behind a link.

### Does Consent Mode v2 fix tags firing before consent?

Basic mode does, by blocking Google tags until consent is given. Advanced mode loads them in a restricted, cookieless state. Either is defensible. What is not defensible is tags firing freely with no consent mode at all.

### What must a consent record prove?

The choice, the time, the banner version shown, and the purposes consented to. A log that only says accepted, with no timestamp or version, is a claim, not proof.