Why your cookie scanner and your consent banner disagree, and which one to trust
Trust the scanner for what fires, trust the banner for what you declared, and treat every mismatch as a defect to fix in one direction or the other.
What each tool actually measures
A cookie scanner measures technical reality: which scripts fire, which cookies get set, which network calls leave the browser on a given page load. A consent banner reflects declared intent: the vendors and purposes you configured and the choices users made.
They disagree because they answer different questions. The scanner sees everything including tag-manager test containers, staging leftovers, and scripts injected by browser extensions on the test machine. The banner shows only what someone configured, which may be months out of date.
The three kinds of mismatch
Scanner finds more than the banner lists: undeclared trackers. This is the dangerous direction, because it means data collection you have no consent story for. Fix by declaring and consent-gating the tracker, or removing it.
Banner lists more than the scanner finds: declared but inactive vendors. Less risky legally, but it confuses users and inflates your vendor list. Clean these up so the banner describes reality.
Categories that do not line up: the scanner calls it advertising, the banner calls it functional. Misclassified purposes undermine consent quality. Reclassify honestly, because regulators read purpose labels closely.
How to run the comparison
Scan the same set of page templates the banner covers: homepage, a content page, a conversion page, and any page with embedded third parties. Use a clean browser profile so extensions do not pollute the results.
Do the comparison quarterly and after every site change that touches tags. Save both reports with the date. When they match, you have evidence of a working consent system, which is the whole point of the exercise.
Which number do regulators care about?
The scanner's. Enforcement looks at what actually fired and whether a valid consent record backs it, not at what your banner claimed.
Our scanner finds trackers only on some pages. Is that a problem?
Only if the banner promises uniform coverage. Scan every template type, and gate tags per template where they actually fire.
How close to zero should the mismatch be?
Zero undeclared trackers is the target. Declared-but-inactive vendors are cleanup work, not violations, but they erode user trust.
Get a free consent audit of your website
Free consent auditFrequently asked questions
What is the TCF and why do publishers use it?
The Transparency and Consent Framework is a standard way for publishers to capture choices and pass them to advertising partners as a structured string. Its value is interoperability: one choice, many vendors reading it the same way. Its risk is the same feature, since a badly set string broadcasts the wrong permissions at scale.
Why do ad partners sometimes ignore the consent string?
Signals get dropped at handoffs: a wrapper that strips parameters, a partner whose integration predates the standard, or a server side flow that never forwards the string. Publishers find these gaps by testing with real declines and tracing what each major partner received, not by trusting integration documents.
How should a publisher handle consent for ad personalization by region?
By treating region as a configuration, not a vibe: the rules, defaults, and vendor purposes differ across jurisdictions, and the setup should switch on detected location with records kept per region. A single global configuration usually ends up too weak for the strictest market or too heavy for the rest.