By John Cookie · Published 4 October 2026
A useful review makes its evidence and limits clear. Here is how to read our public cookie-banner reviews and understand what a separately scoped technical audit can establish.
Download the worksheet
A blank, editable text template for recording your test conditions, evidence, findings and retest actions. Open it in your text editor or paste it into your project notes. No sign-up required.
Download review methodology worksheet (TXT)Version 4 October 2026. Blank fields are not a pass; record what was tested and what remains unknown.
Public reviews and technical audits answer different questions
Our published website reviews describe public observations at a stated time: visible choices, policy information and the visitor journey. A visible script reference is a reason to investigate, not proof that a tag fired. A screenshot of Reject is not proof that every optional technology stopped.
A scoped technical audit can compare consent values, cookies, other browser storage and network activity through agreed journeys. Its report should identify the URLs and conditions tested, configuration access available and anything excluded. See the Consent Mode audit scope and illustrative report format.
Read the capture conditions
Check the review date, page, device or browser details where recorded, and whether the browser was reset. A first-visit claim needs a fresh stored-choice state. Returning-visitor screenshots can show a current interface but cannot establish what a new visitor would see.
Some published reviews include later visual updates. Those screenshots are dated separately from the original findings. If the capture was not reset, or cookies and requests were not inspected, the accompanying limits should say so. Do not read a visual update as a repeat of every original test.
Keep observations, inferences and gaps separate
- Observed
- A visible control, policy statement or recorded technical event supported by the evidence described.
- Needs investigation
- A question prompted by the observation; its cause or technical effect has not been established.
- Not tested
- A behaviour or configuration outside the evidence collected. This is not a pass or failure.
For example, a policy naming an analytics service establishes what the policy says. It does not establish that the service is installed, active, correctly classified or controlled by the banner. A developer needs configuration or runtime evidence to answer those questions.
What a public visibility score means
A Public Visibility & Transparency Score summarises the public criteria in that review. It is not a legal compliance score, certification or guarantee about tag behaviour. Read the component explanations and evidence alongside the total.
For example, the published 43Legal review uses privacy information (25), cookie choices (25), cookie information (15), form transparency (15) and choice persistence (20) as the available points. The review explains which signals were visible and what remained untested. Do not assume identical evidence or weighting for every review; use the breakdown actually published on the page.
Sources and reviewer background
Guides refer to official sources, including the ICO’s storage and access technologies guidance and Google’s Consent Mode troubleshooting documentation. These sources inform the practical checks. They do not endorse our reviews or validate an individual website.
Read About John Cookie for the reviewer’s stated background and use of a pen name. Digital marketing experience is not presented as a legal qualification. Website owners should obtain qualified advice for legal conclusions.
Corrections and changes after publication
A website or its tracking setup can change after a review. If you believe a finding is inaccurate or out of date, send the review URL, disputed statement and relevant dated evidence through the enquiry form. Please avoid passwords, customer information and private payloads. Factual corrections and updates are not conditional on purchasing a service.
New evidence should be tied to its capture date and scope. An update does not silently establish behaviour that was never tested. Explore the case studies and individual review directory to see these distinctions in context.
Live evidence example from our own site
On 4 October 2026, we opened the CookieBanner homepage preference panel in a browser session at a narrow viewport. The panel exposed Essential, Preferences, Analytics and Marketing controls, policy links, and separate reject, save and accept actions.
We enabled Analytics only, saved the choice, reloaded the homepage and reopened settings. Analytics remained on; Preferences and Marketing remained off. We then selected Reject non-essential, reloaded and reopened settings: all three optional controls were off and Essential remained on. These are observations of the visible controls and their persistence, not a claim about all storage or network behaviour.
Recorded limitations: existing browser preferences and an authenticated WordPress session were present. We did not treat this as a clean first visit or a complete technical audit. The dated Tag Assistant example separately records the Google signals visible in that session.
Practical website guidance. Tests are limited to the conditions recorded; this is not legal advice or formal compliance certification.