Consent & Privacy Compliance Audit

What's included

Consent mechanics

• CMP configuration review across your banner, preference center, and category mapping
• Tag firing verification before consent, done by watching network requests rather than trusting the CMP dashboard
• Consent Mode v2 implementation covering ad_storage, analytics_storage, ad_user_data, and ad_personalization
• Advanced and basic consent mode compared, with what each one does to your data
• Default and update command ordering, since a mistimed update call silently breaks the whole model
• Regional gating rules checked against where your traffic actually comes from
• Global Privacy Control and Do Not Track handling
• Cookie inventory showing what gets set, by whom, and at what point

Platform settings

• GA4 data retention, IP handling, and regional data controls
• Google Ads and Meta data processing options, including limited data use flags
• Consent signal pass-through to Meta CAPI and other server-side endpoints
• Third-party scripts loading outside the tag manager, which is where most violations hide
• Data deletion and access request process, and whether anyone can actually run one

Impact on reporting

• Consent rate by region and traffic source
• Modeled conversion share in Google Ads and GA4, so you know how much of your reported performance is estimated
• The gap between consented sessions and reported sessions
• What your numbers would look like under a stricter configuration, in case you need to plan for it

Deliverable

• Findings split by legal exposure and by data impact, since those are separate problems
• Fix list with the critical items implemented
• Plain-language summary you can hand to legal or to a client

Why it matters

Most consent setups are theatre. The banner appears, the user clicks reject, and the pixel fires anyway because someone hardcoded it into the template two years ago. Nobody catches it, because the CMP dashboard records the choice correctly while the tag ignores it.

The second half of this is about your numbers. Consent Mode v2 fills gaps with modeling, which means a share of what your dashboards report was never measured. That's fine as long as you know the size of it and stop treating modeled conversions as observed ones. Most teams have no idea what the split is on their own accounts.