Cookie consent looks simple from the outside: drop a script tag, show a banner, done. In practice, a compliant implementation touches tag management, regional privacy law, accessibility, performance budgets, and analytics data quality. Skip a step and you're either leaking data pre-consent, breaking Consent Mode signals, or serving the wrong banner text to the wrong country.

This checklist walks through every phase of a CMP rollout, from the initial cookie audit to the quarterly re-audit that keeps you compliant as your site evolves. It's written for developers and technical leads who'll own the integration end-to-end. Each step is specific enough to be a ticket on your sprint board.

We've organized the 30 steps into five phases: Planning (1–5), Technical Setup (6–15), Testing (16–22), Launch (23–27), and Maintenance (28–30).

Phase 1: Planning (Steps 1–5)

Skip the planning phase and you'll redo the technical work twice. These five steps define scope and requirements before you write integration code.

Step 1: Audit Every Cookie and Tracker on Your Site

You can't consent to what you haven't inventoried. Run an automated scan across your entire domain, including authenticated pages, checkout flows, and subdomains. Capture cookies, localStorage keys, sessionStorage, IndexedDB entries, tracking pixels, and outbound connections.

For each item, record the name, provider, purpose, first-party vs. third-party status, and expiry. Don't rely on a single-page test: third-party scripts load different trackers on different page types. See how to audit your website's cookies for the full methodology, and how cookie scanners work for why periodic scanning alone leaves gaps.

Step 2: Map Every Cookie to a Consent Category

Assign each item to one of the standard categories: strictly necessary, functional/preferences, analytics, or marketing/advertising. Get this mapping wrong and your entire consent signal chain is meaningless.

Strictly necessary cookies (session tokens, CSRF protection, load-balancer affinity) don't require consent, but the bar for that classification is high. An analytics cookie is never "necessary." See cookie types and categories explained for the detailed taxonomy.

Step 3: Choose Your Consent Model by Jurisdiction

Three common patterns:

Opt-in (GDPR/ePrivacy): Block all non-essential cookies until affirmative consent. Required in the EEA, UK, Brazil (LGPD), and most of the world.
Opt-out (CCPA/US state laws): Cookies may fire immediately, but users must have a clear opt-out path.
Notice-only: Inform the user, no blocking. Acceptable in very few jurisdictions.

If you serve visitors globally, you need a regional consent model. See running one cookie banner across a global audience.

Step 4: Select Your CMP

Evaluate CMPs against technical requirements, not marketing pages:

Does it actually block scripts pre-consent, or just show a banner while tags fire?
Does it support Google Consent Mode v2 natively?
Can it handle regional rules without separate banner configs per country?
What's the bundle size? A 200KB synchronous script will tank Core Web Vitals.
Does it provide automated scanning?

See best cookie consent tools in 2026 and how CMPs block scripts for comparisons.

Step 5: Plan Your Regional Rules

Document the behavior for each region: consent model, button layout, whether to show a banner at all, and language requirements. Map regions to legal frameworks: GDPR for the EEA, UK GDPR for the UK, LGPD for Brazil, CCPA/CPRA for California, and the growing set of US state privacy laws. Your CMP should let you define these as location-triggered rules.

Phase 2: Technical Setup (Steps 6–15)

Each step maps to a discrete code change or configuration task.

Step 6: Install the CMP Script

Place the CMP loader as early as possible in your <head>. It needs to run before any tag that sets non-essential cookies. Most CMPs use a single <script> tag, but some require synchronous loading to guarantee they block tags in time.

For SPAs and SSR frameworks, the CMP must initialize on the server render and persist across client-side navigations. See our guides for Next.js App Router and SPAs (React, Vue, Angular).

Step 7: Configure Default Consent States

Before the user interacts with the banner, set default consent states. For opt-in jurisdictions, default to denied for all non-essential categories. For opt-out jurisdictions, default to granted.

These defaults are what GTM reads on page load via the consent command. If you don't set them, GTM assumes granted and your tags fire pre-consent. This is the most common implementation mistake.

Step 8: Set Up Google Consent Mode v2

Push a default consent('default', {...}) command before the GTM container loads, then fire consent('update', {...}) when the user chooses. Configure all five signals: ad_storage, analytics_storage, ad_user_data, ad_personalization, and functionality_storage.

Decide between basic or advanced Consent Mode: basic blocks all Google tags when denied; advanced sends cookieless pings for behavioral modeling. For the full setup, see GTM and consent setup.

Step 9: Block Non-Essential Scripts Until Consent

Every tag, pixel, SDK, and widget that sets non-essential cookies must be blocked until the user consents. Common blocking patterns:

Type attribute swap: Change type="text/javascript" to type="text/plain" with a data-category attribute. The CMP re-enables them post-consent.
GTM consent checks: Add consent requirements to each tag so they only fire when the signal is active.
Programmatic gating: Wrap inline scripts in a consent callback.

See how to block scripts until consent for details.

Step 10: Test Script Blocking Immediately

Don't wait for QA. After blocking each script, open DevTools, clear all storage, reload, and confirm:

No non-essential cookies appear before consent.
The blocked script's network requests don't fire.
After granting consent, the script loads and sets its cookies.
After revoking, cookies are cleared on next navigation.

Check the Application tab too. Some trackers write to localStorage or IndexedDB.

Step 11: Handle Third-Party Iframes

YouTube, Google Maps, social widgets, and chat tools load in iframes and set cookies outside your blocking flow. Strategies:

Replace iframes with placeholders until the user consents.
Use the sandbox attribute to strip cookie access.
For YouTube, use youtube-nocookie.com embed URLs.

Test every embedded widget individually.

Step 12: Configure Cookie Persistence and Expiry

Your CMP stores consent in a cookie or localStorage. Configure:

Expiry: 6 to 12 months maximum (jurisdiction-dependent).
Domain scope: Root domain for shared subdomains, or isolated per subdomain.
Storage mechanism: Cookies are standard; localStorage survives cookie clears but isn't sent to the server.

See consent expiry and when to re-ask.

Step 13: Respect Global Privacy Control (GPC)

GPC is a browser-level signal (Sec-GPC: 1 header / navigator.globalPrivacyControl API) that communicates opt-out preference. Under the CCPA and other US state laws, honoring it is legally required. Configure your CMP to detect GPC and set marketing consent to denied automatically.

Step 14: Add a Floating Consent Button

GDPR Article 7(3) requires that withdrawal be as easy as giving consent. Add a persistent floating button that reopens preferences on any page. Don't bury it in a footer link or behind a settings page.

Step 15: Configure Dark Mode and Responsive Design

If your site supports dark mode, the banner should match. A bright popup over a dark UI looks bolted-on. Verify the banner works on all viewport sizes and actual devices. It should never obscure checkout buttons or extend beyond the viewport on mobile.

Phase 3: Testing (Steps 16–22)

Testing consent is tricky because you're verifying the absence of behavior. You need to confirm things don't happen until they should.

Step 16: Verify Zero Pre-Consent Cookies

Clear all site data, load in a fresh incognito window, and check DevTools before touching the banner. The only cookies present should be strictly necessary (session IDs, CSRF tokens, load balancer affinity). If you find analytics or marketing cookies, your blocking is broken.

Step 17: Test All Consent States

Walk through every combination:

Accept all: all tags fire, all expected cookies appear.
Reject all: no non-essential cookies, no tracking requests.
Partial consent: only the permitted category's tags execute.
Consent then withdrawal: revoke and verify cookies for revoked categories are cleared.
Ignore the banner: navigate pages without interacting, confirm no non-essential cookies appear.

Step 18: Verify Consent Mode Signals

In GTM preview mode or via the dataLayer, confirm:

Default consent fires before any tags.
The update event fires when the user chooses.
Each signal (ad_storage, analytics_storage, ad_user_data, ad_personalization) reflects the actual choice.
In advanced mode, cookieless pings fire when consent is denied (gcs= parameter in Network tab).

See how to debug Consent Mode v2.

Step 19: Test Regional Rules

Use a VPN or your CMP's geo-override to simulate visitors from each configured region:

Correct consent model activates (opt-in for GDPR, opt-out for CCPA).
Banner text matches the expected language and legal requirements.
Button layout matches your spec (reject-all visible on first layer for EEA).

Step 20: Check Mobile Behavior

Test on actual devices, not just emulation:

Banner doesn't obscure the viewport or hide critical UI.
Buttons and toggles are tappable (44x44px minimum).
Consent persists across app-to-browser handoffs.
Performance is acceptable on mid-range devices with throttled connections.

Step 21: Test Accessibility

Your banner is a legal obligation, so it must be usable by everyone:

Focus trapping: no tabbing to content behind the banner.
Keyboard navigation in logical order.
Screen reader announces purpose and actions.
WCAG 2.1 AA contrast (4.5:1 text, 3:1 interactive).

See cookie banner accessibility and WCAG.

Step 22: Verify Performance Impact

Run Lighthouse before and after. Compare LCP, CLS, and INP. Check the CMP script's transfer size and ensure it loads asynchronously. A CMP that tanks your Core Web Vitals is a bad trade. See cookie banner performance and Core Web Vitals.

Phase 4: Launch (Steps 23–27)

Step 23: Deploy to Staging

Deploy the full CMP integration to staging first. Run Phase 3's test suite against it, not just localhost. Staging should match production's tag config, third-party integrations, and CDN setup. Verify geo-detection works behind any IP restrictions.

Step 24: QA with Stakeholders

Run through the consent flow with each stakeholder group:

Legal: Banner text, category descriptions, cookie policy.
Marketing: Tags fire post-consent, attribution data flows.
Analytics: GA4 and ad platforms handle denied consent correctly.
Design: Brand guidelines, dark mode, mobile rendering.

Step 25: Go Live

Deploy to production. Immediately after: clear cookies and walk through the flow on desktop and mobile, verify no pre-consent cookies, check Consent Mode in GTM debug view, spot-check regional rules via VPN. Don't deploy on a Friday afternoon.

Step 26: Monitor Consent Rates

Within 48 hours, check your consent analytics. If your accept rate is below 40% in opt-in regions, your banner design may need work. See consent rate benchmarks by industry. Look at category-level breakdown (analytics accepted, marketing rejected is normal) and drop-off rates.

Step 27: Verify Analytics Data Quality

Compare session counts and conversions to the pre-CMP baseline. A drop is expected in opt-in regions, but 90%+ drop indicates broken tag firing. Verify modeled conversions appear in GA4 if you're using advanced Consent Mode. See measuring consent impact on analytics.

Phase 5: Maintenance (Steps 28–30)

A CMP is not a set-and-forget tool. Your site changes. Third-party scripts update. Laws evolve. Without ongoing maintenance, you'll drift out of compliance within months.

Step 28: Set Up a Regular Scanning Schedule

Configure automated cookie scans on a recurring schedule: weekly for high-traffic sites, biweekly at minimum. Each scan should compare the current cookie inventory against your documented categories and flag anything new or changed.

When a scan finds an uncategorized cookie, that's a gap: a script is setting a tracker that your banner doesn't cover, meaning consent for that cookie was never collected. Treat new cookies as incidents that need categorization and CMP configuration before your next deploy.

Step 29: Monitor for Drift

Between scans, monitor for real-time drift. Third-party scripts can change their behavior without warning. A chat widget update might start setting marketing cookies it didn't set before. A developer might add a new analytics tag without going through the consent integration process.

Drift detection catches changes as they happen, rather than waiting for the next scheduled scan. Set up alerts so your team knows immediately when a new uncategorized cookie or tracker appears on the live site.

Step 30: Run Quarterly Re-Audits

Every quarter, revisit the full checklist:

Re-run the cookie audit (Step 1). Compare results against your documented inventory. Categorize anything new.
Review your regional rules (Step 5). New privacy laws take effect regularly. The US alone has added several new state laws in the past year. Check whether your regions need updating.
Re-test consent states (Step 17). Confirm that blocking still works after any site, CMP, or tag manager updates.
Check consent rates (Step 26). A sudden drop might indicate a broken banner; a spike might indicate a dark pattern was accidentally introduced.
Review consent expiry (Step 12). Are returning visitors being re-prompted at the right intervals?
Audit Consent Mode signals (Step 18). Verify that analytics platforms are still receiving the signals they expect.

Document each re-audit with dates and findings. This documentation is what you produce when a regulator asks how you maintain compliance, and it's the backbone of your proof of consent under GDPR.

Using This Checklist

Copy this checklist into your project management tool and assign each step to a sprint. Steps 1–5 are prerequisites that should happen before any code is written. Steps 6–15 can be parallelized across developers. Steps 16–22 should happen in a dedicated testing sprint. Steps 23–27 are your launch sequence. Steps 28–30 become recurring tasks.

The most common failure mode isn't missing a step. It's doing steps 6–15 without doing steps 1–5, which means you're integrating a CMP without understanding what it needs to block, which consent models apply, or how your regions should behave. The planning phase is what makes the technical work correct.

Cookie consent implementation isn't glamorous engineering, but getting it right protects your users' privacy, keeps your organization on the right side of regulators, and ensures your analytics data actually means something. That's worth 30 steps.