Consent Preference Center QA Checklist: Test Withdrawal, Categories and Consent Mode

A cookie banner is only the first screen. The harder test is what happens when a visitor changes their mind a week later.

Can they find the settings again? Can they switch analytics off after accepting it? Does the site remember the new choice on the next page? Do marketing tags actually stop? Does Google Consent Mode receive the update? And can your team show, afterwards, when the change happened?

Quick answer: before launch, and after every tag change, test the full preference center path: first visit, accept all, reject all, category choices, reopening the settings, withdrawal, Consent Mode values, real tag firing, the consent log, and mobile. If giving consent takes one click but changing or withdrawing it takes five, the setup is not ready.

This checklist is an operational test plan, not legal advice. The rules it tests come from regulators and are linked at the end.

Why the preference center matters

Consent is not a one-time pop-up. The law treats it as an ongoing choice that the visitor can change.

• EU: Article 7(3) of the GDPR gives people the right to withdraw consent at any time and says it must be as easy to withdraw as to give. The EDPB consent guidelines add that if consent was given with one click, withdrawal should be just as easy in practice.
• UK: cookie consent under PECR uses the UK GDPR standard, so the same "as easy to withdraw" rule applies. The ICO's guidance on storage and access technologies covers how this works for cookies and similar tools.
• India: Section 6(4) of the Digital Personal Data Protection Act, 2023 gives the right to withdraw consent at any time, with the ease of doing so comparable to the ease of giving it.

The practical risk is drift between what the visitor sees and what the site does. A visitor believes analytics is off while a tag still fires. Marketing believes remarketing is running while Consent Mode is blocking ad storage. A developer believes the banner handles everything while a script loads before the default consent state is set. Nobody can show when a visitor changed their choice.

The preference center is where the visible choice, the technical behaviour and the evidence have to line up.

The consent preference center QA checklist

Run it in a private browser window with developer tools open, and repeat it on a phone.

1. First visit: default state

Open the site as a new visitor and check:

• the banner appears for the regions where you show it;
• optional categories are off by default where consent is required;
• no analytics or advertising requests leave the page before a choice is made;
• a persistent link or button to reopen the settings is visible;
• the wording is plain enough for a normal visitor.

For Google tags, Google's consent documentation says the default consent state must be set before any measurement command sends data. Check the order in the network panel, not just in the tag manager.

2. Accept all

Click Accept all and check:

• the choice is stored and the banner closes;
• analytics and marketing tags start only after the click;
• the consent log records the choice;
• the preference center shows every category as granted;
• the choice holds on the next page and after a reload.

This is the easy path. Do not stop here.

3. Reject all

Clear storage, start again, click Reject all and check:

• the banner closes and does not reappear on the next page;
• optional analytics and marketing tags stay blocked;
• only strictly necessary cookies are set;
• the refusal is logged;
• navigation, forms and checkout still work.

Our Reject All button guide covers what regulators expect from the button itself.

4. Category choices

Open the preference center and switch categories on one at a time: analytics, marketing, preferences, support chat, embedded media.

For each one, confirm the category maps to real scripts. If marketing is off, the ad pixels should not load. If analytics is off, analytics storage should stay denied. If chat is its own category, the chat widget should follow it. A category that controls nothing is a common finding, and so is a script that belongs to no category at all.

5. Reopen and withdraw

Accept all, browse to another page, then reopen the preference center and switch everything optional off. Check:

• the settings link is easy to find from any page, including on mobile;
• withdrawing takes no more steps than accepting did;
• the stored choice changes immediately;
• optional tags stop on the next page view;
• cookies already set by those tools are removed or expire where your setup supports it;
• the change is logged as a separate event with its own timestamp;
• the site does not quietly fall back to the old "accepted" state after a reload.

This is the single most important test on the list, because it checks the "as easy to withdraw as to give" rule directly.

6. Google Consent Mode v2 values

If the site uses Google tags, check all four Consent Mode v2 values:

• ad_storage
• analytics_storage
• ad_user_data
• ad_personalization

Confirm the default values before interaction, then confirm a consent update is sent after accept, reject, each category change and withdrawal. Google's documentation lists ad_user_data and ad_personalization as the newer advertising signals, so a test that only checks the first two values is incomplete. Our Consent Mode v2 explainer walks through each signal.

7. Real tag behaviour

Use the browser network panel, Tag Assistant or your tag manager's preview mode and record what fires:

• before any interaction;
• after accept all;
• after reject all;
• after each category change;
• after withdrawal;
• on the next page view after each of the above.

The preference center is ready only when real requests match the interface. A cookie scan helps you build the list of tools to watch, but the network panel is the final check.

8. Consent log evidence

For each test case, keep enough evidence to explain what happened later:

• timestamp and page URL;
• categories chosen;
• banner or policy version shown;
• device type and browser;
• the change or withdrawal event;
• a note of what fired before and after.

The log is not only for complaints. It is also how your team spots a regression after someone adds a tag. Our guide to consent logging covers what a useful record contains.

9. Mobile and language

On a phone, check that:

• Accept, Reject and Manage options are all visible without scrolling past them;
• the preference center scrolls and its toggles can be tapped;
• no sticky header, chat bubble or cookie button hides a control;
• category descriptions are readable and not pressured or misleading.

For India-facing sites, note that the DPDP Act gives people the option to read the notice in English or in a language listed in the Eighth Schedule of the Constitution. Treat language as part of the test, not decoration.

10. Retest after every change

Consent QA is not one-and-done. Re-run at least steps 1, 3, 5 and 7 when:

• an advertising pixel or analytics tool is added or changed;
• a chat, heatmap or session-recording tool is installed;
• the tag manager container is published;
• the site theme, framework or checkout changes;
• the privacy notice or cookie policy changes.

A clean setup can drift after one marketing experiment. If you change your policy, our note on how long consent lasts explains when to ask again.

A simple worksheet for every release

Keep one line per test case:

• First visit: default state set before any tracking. Keep a screenshot and the network log.
• Accept all: categories granted and logged. Keep the log entry and tag check.
• Reject all: optional tags blocked and logged. Keep the log entry and network check.
• Category change: only the chosen categories run. Keep a screenshot of the settings.
• Withdrawal: state moves from granted to denied. Keep the log entry and a next-page check.
• Mobile: every control visible and usable. Keep a phone screenshot.
• New tag: category mapping confirmed. Keep the scan result and the owner's sign-off.

The point is not paperwork. It is to stop guessing.

Where COKIQ fits

COKIQ provides a cookie consent banner with category handling, consent logging and guidance for Google Consent Mode v2. The checklist above is the test plan to run against your COKIQ setup, or against any other consent tool, before each release.

It is not legal advice, regulator approval or a guarantee of compliance. Which categories need consent and what your notice says should be confirmed by whoever owns privacy for your business. You can run a free scan to see which cookies and scripts your site loads before you start testing.

Sources

• Regulation (EU) 2016/679 (GDPR), Article 7(3), EUR-Lex
• Guidelines 05/2020 on consent under Regulation 2016/679, European Data Protection Board
• Guidance on the use of storage and access technologies, UK Information Commissioner's Office
• Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology, India
• Set up consent mode, Google for Developers