# Audit consent management: find tracking and hidden third parties > A practical consent management audit for German SMEs: find cookies, trackers and third parties, test rejection and document consent correctly. - Quelle: https://bezahlbare-webseite.de/en/ratgeber/consent-management-tracking-pruefen/ - Datum: 2026-11-08 - Sprache: en - Thema: Recht & Datenschutz Consent management is more than adding a cookie banner. The decisive questions are whether consent-based tracking is blocked before a choice, whether rejection works and whether the banner accurately reflects the live website. ## What does working consent management include? Consent management records services that store information on a visitor’s device or access information already stored there. It assigns purposes and controls each service according to the user’s decision. Cookies, local storage, analytics scripts, advertising pixels, videos, maps, chats and external media servers may all be relevant. A visible banner alone therefore proves nothing about technical control. Section 25 TDDDG generally requires consent for storing or accessing information on terminal equipment. Exceptions notably cover message transmission and access strictly necessary to provide a digital service expressly requested by the user. Information and consent must follow GDPR rules. Source: German federal legislation portal, Section 25 TDDDG, accessed 8 November 2026. The practical order for an SME is simple: build the technical inventory first, then review purpose, legal basis and banner category. A text-only review can miss scripts that send data during the first page load. - Inventory services and providers - Assign purpose, device access and recipients - Block non-essential services until consent - Test rejection and withdrawal - Align the banner, privacy notice and real connections ## How can you find cookies, trackers and third parties? Begin in a private browser window with cleared site storage. Test the homepage, contact page, booking flow, shop, blog, videos, maps and embedded forms. Many third parties appear only on a particular page or after interaction. The browser developer tools show contacted domains in “Network” and cookies or storage entries in “Application” or “Storage”. Filter for external domains and record the provider, time and triggering page. Automated scanners are useful, but they do not replace manual tests across page types and consent states. Compare the results with the tag manager, plugins, hosting setup, embeds and the provider list inside the consent management platform. The Bavarian supervisory authority’s SME checklist expressly includes cookies, tracking pixels and other reach-measurement methods and expects information on purposes, recipients and possible international transfers. Source: BayLDA SME retail checklist, accessed 8 November 2026. ## Testing consent management: what may load before a choice? The most important test happens before any click. Load the site from a clean state and observe network requests, cookies and storage. Essential functions may run, but analytics, advertising and other non-essential services should not send data merely because the banner is visible. Videos, maps and chats may also contact a third party during initial rendering. Test four states separately: no choice, reject, selected categories and accept all. Start a fresh private session for every state so a previous consent does not distort the result. Then withdraw consent and check that future page views no longer start the deselected service. In 2024, BayLDA automatically examined more than 350 websites. Its banner review focused on whether a first-layer rejection option existed alongside “accept all”, because consent and rejection should be equally easy. Source: BayLDA press release “Apps und Cookie-Banner auf dem Prüfstand”, 9 February 2024, accessed 8 November 2026. - Fresh visit: essential technology only - Reject: no analytics or marketing tags - Selection: only chosen categories load - Accept: approved services work - Withdrawal: future access is blocked again ## Which consent management platform errors are common? The interface may look correct while implementation is not. A plugin update, new advertising pixel or script inserted directly into the theme can bypass blocking. Services are also misclassified: an analytics tool may be labelled “necessary” although its configuration is not strictly needed for a service expressly requested by the visitor. Other warning signs include preselected switches, a prominent accept button beside a hidden rejection link, vague bundled purposes and a provider list that does not match network traffic. BayLDA states that a banner is not required when a site uses only technically necessary cookies. A banner should therefore control a genuine choice rather than create a general impression of compliance. Source: BayLDA FAQ, accessed 8 November 2026. Review embedded content after rejection as well. A proper two-click solution first loads a local placeholder and contacts a video, map or social provider only after deliberate approval. Questions about necessity, joint control or international transfers may require qualified German data-protection advice. ## How should the banner, privacy notice and technology align? Maintain a list containing service, provider, purpose, category, device access, legal basis, storage period and recipients. This is the bridge between implementation, banner and privacy notice. Remove deleted tools from the texts and assess every new service before launch. The privacy notice must describe actual processing. The BayLDA checklist names purposes, legal bases, data types, recipients, international transfers and data-subject rights. The banner should also explain device access, purposes, recipient categories and withdrawal. Source: BayLDA SME retail checklist, accessed 8 November 2026. Record the audit date, tested URLs, browser states, screenshots and suspicious connections. This does not replace legal advice, but it demonstrates that the company reviewed its specific implementation instead of merely purchasing a banner. ## How often should an SME repeat the consent audit? There is no general statutory three- or six-month audit interval. Our organisational recommendation is to test immediately after website, plugin, tag-manager or campaign changes and to add a recurring review. Monthly may suit a frequently changed marketing site; quarterly may suit a stable small-business site. These are practical intervals, not legal deadlines. Assign an owner and treat every new tool as a short approval process: define purpose, check the provider, configure blocking, update information, test four states and document the result. A managed website subscription can combine updates and technical checks, while the business remains responsible for legal bases and any required legal assessment. Prioritise by impact. Tracking before consent, missing rejection and ineffective withdrawal are more urgent than awkward wording. Incomplete provider lists and outdated privacy information follow. This turns consent management into a controlled process rather than a banner installed once and forgotten. ## Frequently asked questions about consent management ### Is a cookie banner enough for consent management? No. It must technically control the live services, and non-essential trackers must remain blocked before the decision. ### How can I find hidden trackers? Test several page types in a private window and inspect network requests, cookies and other site storage in browser developer tools. ### Must rejection be available on the first banner layer? Supervisory authorities expect an equally accessible rejection option. BayLDA explicitly tested first-layer rejection in 2024. ### Does every website need a cookie banner? No. A banner may be unnecessary if only technically necessary access is used, although the implementation and information duties still need review. ### How often should consent management be audited? After every relevant change and on a recurring schedule appropriate to the site’s change risk. There is no universal statutory monthly interval. --- Veröffentlicht von bezahlbare-webseite.de — Website im Abo ab 79 €/Monat. https://bezahlbare-webseite.de/