What the Tracking Check tests

A cookie banner is the visible half of the consent flow, no CMP means no documented opt-in.

If nothing fires after "Accept", the consent wiring is likely broken, you lose data despite opt-in.

Since March 2024 Google requires all four consent parameters for Ads, otherwise no conversion modelling.

Advanced keeps sending cookieless pings with the gcs parameter after rejection, basic sends no Google measurement at all. The deep scan reads the mode off the reject state.

Consent Mode V2 needs a gtag consent update after opt-in, otherwise Google conversion modelling stays off.

IAB TCF v2.2 and GPP are the standards for cross-vendor consent in EU ad-tech.

Chrome abandoned its 3rd-party cookie phase-out in 2025 in favour of user choice; Safari and Firefox have long blocked them, tracking built on this stays structurally unreliable.

The scanner reads the publicly served Borlabs config and decodes its opt-in codes: container IDs and custom loaders that only load after consent become visible, no click needed.

When the Google Tag Manager service sits in a CMP group like "external media", visitors who consented to statistics are never measured. The check reads the mapping from the Borlabs config.

The deep scan drives the cookie banner automatically and compares the accept state with the reject state.

Cookies set before the consent decision are a typical compliance finding.

Trackers referenced before consent only become a violation once they execute. The check lists the references; whether CMP blocking or Consent Mode stops execution is what the deep scan shows.

The scanner locates the privacy policy link, fetches the page and reads it as the source for matching the policy text against the detected tracking stack.

The scanner holds the visible text of the privacy policy against the detected tracking stack and lists every tool in use that the policy never mentions.

If marketing or analytics still fire after "Reject", that is the single most common GDPR finding at supervisory authorities.

Server-to-server conversion APIs (Meta CAPI, TikTok Events API) deliver attribution even without cookies.

Without a dataLayer, tracking tools scrape values from the DOM, fragile and inconsistent.

Two GA4 properties or two GTM containers on the same page double-count pageviews. The check lists every ID it finds, including dead UA leftovers.

Server-side tagging bypasses ad blockers, stabilises attribution, and decouples tracking from the frontend.

The deep scan reads from the request log whether measurement pings run through a first-party endpoint or go straight to Google: client-side, hybrid or server-side.

Without an analytics tag, nothing flows into Google Ads, Looker, or your reporting.

A central tag manager decouples tracking changes from your release cycle.

GA4 drops revenue without a currency, and mixed currencies make totals unusable. The check tests the currency in JSON-LD, dataLayer and DOM.

The check compares the visible price on real product pages with JSON-LD Offer.price and the dataLayer. Deviations distort ROAS and revenue reports.

Without Product JSON-LD carrying an Offer price, search price snippets disappear and AI search cannot cite product data. The check tests real product pages.

On detected shops the deep scan checks up to five real product pages: visible price, JSON-LD, dataLayer and view_item, compared directly.

Without view_item on product pages, GA4 e-commerce reports stay empty and remarketing lists never fill. The check tests the event on real product pages.

Google largely wound down the Privacy Sandbox in 2025, several ad APIs are being retired. This check is an inventory signal, not a recommendation.

Third-party scripts loaded synchronously in the head hold up first paint; every second of load time measurably costs conversions.

More external scripts = slower load times and a larger compliance surface.

More than 200 KB of tracking payload measurably slows the page and enlarges the compliance surface.

GPTBot, ClaudeBot, PerplexityBot decide whether your content shows up in AI answers, make a deliberate call.

HSTS, X-Frame-Options, and CSP are the security baseline every audit checks.

Unencrypted tracking is a data-leak risk and breaks modern browser defaults.

Structured data (schema.org) is a ranking signal for Google AND AI search.

llms.txt is the emerging standard for telling LLMs in a structured way what they may read.

Title, description, and Open Graph are the SEO baseline, missing them hurts visibility and social shares.

A misconfigured robots.txt makes the site invisible to Google.