A working cookie banner does two jobs: it explains tracking clearly and passes visitors' choices to the tools on your website. CookieScript helps with this, but displaying a banner does not establish that analytics, advertising and embedded services respect consent. This article covers implementation and the checks that make it reviewable.
When does a website need cookie consent?
Under Finland's Traficom guidance, cookies necessary for a service the visitor requests do not require consent. Shopping basket functionality can be an example. Analytics and advertising cookies cannot be classed as necessary simply because a business wants marketing data.
Consent must precede non-essential storage or access. The choice must be voluntary and informed, refusal easy and withdrawal available later. The assessment also covers technologies similar to cookies.
What does CookieScript handle, and what remains your responsibility?
CookieScript is a consent management platform, or CMP. It can display a banner, scan cookies and control tracking. Treat the scan as an inventory to review: the website owner still needs to identify each tool's purpose and check its category.
CookieScript's own documentation states that third-party cookie blocking needs separate configuration. It is not automatically correct when the banner appears. Choose whether CookieScript or your tag management setup controls blocking, and avoid overlapping implementations for the same script.
Implementation: map your tools before installing
Start with analytics, advertising pixels, chat tools, video and map embeds, and booking services. Review forms, authenticated pages and every language version too. A scan of the homepage alone cannot establish how the entire website behaves.
For direct installation, CookieScript instructs you to add its code to the page's head section. Automatic script blocking requires it to appear before the scripts it should block. In Google Tag Manager, the CookieScript template uses the Consent Initialization - All Pages trigger.
- Record each tool's purpose, owner and consent category.
- Make acceptance, refusal and custom choices clear.
- Review banner wording and cookie information in every website language.
- Configure tracking defaults and consent-dependent activation.
- Add a permanent Cookie settings link for changing choices.
- Test the implementation before launch and record the results.
Test choices in the browser, not just the banner's appearance
Open a clean browser session and inspect storage and network activity using developer tools. Start each test below in a new session so earlier consent does not affect the result. Test navigation to another page and reloading as well.
For example, statistical consent for Google Analytics must not by itself activate Meta advertising tracking. Also check that your contact form and other core website functions remain usable after refusal.
| Test case | What to check |
|---|---|
| Before a choice | Non-essential storage does not start by default. |
| Reject all | Optional cookies remain blocked on the next page too. |
| Accept statistics only | Statistical tracking respects the choice while marketing remains blocked. |
| Accept all | Permitted tools activate without duplicate events. |
| Withdraw consent | The updated choice reaches tools and prevents further tracking that depends on that consent. |
Consent Mode v2 passes choices to Google
Google Consent Mode adjusts Google tags according to consent state. It is not a banner or a guarantee of compliance. Key states include analytics_storage, ad_storage, ad_user_data and ad_personalization.
Basic implementation blocks Google tags until consent. Advanced implementation can load tags earlier and send cookieless requests. An absence of cookies therefore does not prove an absence of data transmission. Choose the implementation against your data-processing requirements and verify both the default state and its update after a choice.
How do you choose a CookieScript plan?
Compare your needs against the current plan list: scanned pages and domains, scan frequency, automatic script blocking and consent recording can affect the choice. Consent Mode support alone does not establish that every feature you need is included.
Ask your provider to separate the licence, implementation, testing and ongoing maintenance. Agree who reviews settings when a new advertising tool or embedded service is added. This keeps consent management aligned with website changes.
Keep consent management in your maintenance routine
Run another review whenever tracking, a plugin, a form or an embed changes. Keep the tool inventory, settings and test results so the next maintainer can understand the implementation. The first priority is making visitors' choices work, before assessing banner acceptance rates.
Consent management is one part of website privacy. Read about GDPR requirements for websites and website maintenance to include responsibilities and checks in your regular work.
Let's map your website's tools and agree on consent implementation, testing and maintenance. Contact Digitari.
Sources and further reading
Consent requirements follow Finland's Traficom guidance. Installation and tag behaviour have been checked against CookieScript and Google documentation.
