← Consent Change Record

What did my cookie banner actually change?

The banner renders. The buttons work. The vendor dashboard is green. None of that answers the question a client or a reviewer actually asks: when someone declines, what stops happening?

Frequently the answer is "less than you think." Consent tooling is configured separately from the scripts it is meant to gate, so a tag added later by a marketing team, a script loaded by another script, or a vendor that ignores the consent signal keeps firing behind a perfectly correct banner — invisibly, because the interface is not where the failure shows.

Open the free consent change record

Compare two states, not one

Capture what the page does before the consent choice and again after it, then diff the two. What you want out of the comparison is:

A trace holds only metadata — url, method, and storage key values — plus the site, capture time, browser, and which sequence it is. That is enough to answer the question and deliberately not enough to carry page content.

How to use it

  1. Capture a before-consent and an after-consent trace of a site you own or are authorized to test.
  2. Paste both into the page and choose Compare traces. Nothing is uploaded and there is no account.
  3. Download the report as your dated review artifact.
  4. If you already have DevTools HAR captures instead, the sibling HAR comparison tool diffs two HAR files and groups known tracker domains.

What the record is, and is not

It is a dated, source-linked list of observable differences between two captures — useful in a client review, a handover, or a file you keep. It is not a compliance determination, and it does not claim a site is lawful under any privacy regime. The observations are the evidence; what they mean for your obligations is a question for a qualified professional.

Common questions

How do I check what my cookie banner actually changes?

Capture what the page does before the consent choice and again after it, then compare the two. Record the outbound requests and the storage keys written in each state and diff them. That comparison answers the question the banner's own screenshot cannot: which third-party requests only appear after consent, which appear regardless, and which storage keys are written either way. A banner that renders correctly and blocks nothing is a common and entirely invisible failure.

Why is a screenshot of the banner not enough?

A screenshot shows the interface, not the behaviour. Consent tooling is usually configured separately from the scripts it is supposed to gate, so a tag added later by a marketing team, a script loaded by another script, or a vendor that ignores the consent signal will keep firing behind a perfectly correct banner. Only observing the requests and storage in each state shows what the banner does.

Does this prove my site is compliant?

No. It produces a dated record of observable differences between two traces you captured — request URLs and methods, and storage keys. It is evidence for a review, not a compliance badge, and it makes no determination under any privacy law. Only test sites you own or are authorized to test, and take advice from a qualified professional on what the observations mean for your obligations.