Audit · MANTIS guide
Test cookie consent behavior
Check which analytics tags, pixels and cookies appear before a visitor makes a choice, after Reject all, and after Accept all. Use MANTIS for Chrome to trace what changed and when.
Record one browser session per consent choice
Start each run with fresh site storage and no saved consent preference. Start recording from the MANTIS toolbar icon. MANTIS reloads the selected tab to capture the initial page load. Keep the URL, browser settings, region, wait time and interactions consistent across runs. Repeat a relevant action, such as opening a product detail page, to check tags that fire after the initial page load.
- Before any choice. Leave the banner untouched. Record the initial load and note any tags, collection requests or storage that appear during your test window.
- After Reject all. Start a fresh run, reject optional categories, then repeat the same actions. Check whether the recorded consent update and subsequent requests reflect the choice. Reload or navigate if you need to verify that it persists.
- After Accept all. Start another fresh run, accept all categories, and repeat the actions. This gives you a reference for the tags, payloads and cookies that appear when consent is granted.
- After withdrawal. In the accepted session, reopen privacy settings and withdraw consent. Compare requests and storage after the update. Record which cookies remain separately from evidence of any new writes or subsequent use.
Check consent at the time each request started
Use the Timeline to find the observed consent default and update events. In Requests, inspect the request’s start time, destination, initiator, payload and any consent evidence available at that moment. Record missing or ambiguous consent evidence as unknown. A later grant belongs to the later part of the session.
Compare tags, collection requests and cookies
Use Review → Compare to see which request patterns were added, removed or changed between captures. Open the individual requests to see what the browser sent. Inspect Cookies and localStorage separately to see which entries were present in each capture.
- Tag loads. Identify scripts and their initiators. A tag loader and a subsequent event submission are separate observations.
- Collection requests. Compare destinations, event names, consent parameters and identifier fields when captured. Google tags configured for advanced Consent Mode can send measurements without cookies while storage consent is denied. See Google’s Consent Mode overview.
- Browser storage. Check what appeared or changed and when. Look for cookie write evidence, such as a response’s
Set-Cookieheader, when available.
Write a finding someone else can reproduce
Record the page, browser conditions, choice, action, observed consent state and relevant request or storage evidence. For example, if a tag loads on both paths and the identifier field appears only after acceptance, record the shared loader and the payload difference as two separate observations. Use Audit → Save JSON to reopen the capture later. Redact sensitive details from anything you share.
Findings describe the sessions and actions you recorded. A compliance determination needs the applicable policy and legal context. Verifying what a server forwards after receiving a browser request requires server-side evidence.
For an example of tracing a tag on a custom domain, follow the first-party tag inspection walkthrough.