Consent-ready tracking checklist

For Canadian stores running Google and Meta. Work through it in a private browser window with the Network tab open. Each box you cannot tick is a gap in your consent setup, your data, or both.

Before the visitor chooses

Open the site in a private window and leave the banner untouched.

01Consent Mode v2 defaults are set to denied for ad_storage, analytics_storage, ad_user_data and ad_personalization before any tag loads.
02No requests go to Google Analytics, Google Ads, Meta, TikTok or other ad tools while the banner is unanswered (check the browser Network tab).
03No analytics or advertising cookies (such as _ga, _gcl_au or _fbp) are set on first load.
04Tag Manager tags that use personal information have consent checks, and the consent default fires on the Consent Initialization trigger.

What the visitor sees and how easy it is to say no.

05Refusing is as easy as accepting: both choices sit on the first layer, with equal weight.
06No optional category is ticked in advance.
07Each category says in plain words what it is for and names the main third parties that receive data.
08The banner links to the privacy policy and cookie policy, and does not hide them.
09Visitors can change their choice later from every page, for example with a cookie settings link in the footer.
10The banner works with a keyboard and a screen reader, and fits a phone screen without covering the whole page.

After a choice

Test each path in a fresh private window: accept, refuse, and ignore.

11Accept: a consent update to granted is sent, then the tags fire and events carry their IDs and values.
12Refuse: the update stays denied and nothing non-essential fires on this page or the next ones.
13Ignore: while the banner is open and unanswered, nothing non-essential fires as the visitor browses.
14The choice is remembered across pages and visits, and the visitor is asked again after a set period.

Platforms and server-side

Consent has to follow the data beyond the browser.

15The Meta pixel and Conversions API follow the same consent decision, so server events do not bypass a refusal.
16A server-side container receives the consent state with each event and forwards, limits or drops it per vendor.
17Google Ads enhanced conversions only send hashed customer data when ad_user_data is granted.
18Your store platform consent setting (the Shopify Customer Privacy API, or your WooCommerce consent plugin) is connected to the same banner.

Records and policy

What you can show if a customer or regulator asks.

19Each choice is recorded with its date and time, the categories chosen and the banner version.
20The privacy policy lists the purposes of tracking, the tools that receive data, and whether data leaves Quebec or Canada.
21The person in charge of protecting personal information is named, with a way to contact them.
22Retention periods are set in GA4 and the ad platforms, and match what the privacy policy says.
23Someone re-runs the accept, refuse and ignore tests after every new app, theme change or tag change.