On most sites the cookie banner is the first thing a visitor sees, and on most capture sets it is the first thing thrown away. Someone clicks Accept so the screenshots are clean, and the one piece of the page that privacy, legal and regulatory teams all have an opinion about never reaches the reviewer.
This guide covers what those reviewers are checking, the captures that give it to them, why the banner is awkward to capture by hand, and how to do it reliably. It is written by RouteShot, which captures consent states automatically; the last section is our case, and the rest applies however you capture. It is not legal advice.
Why the banner is review content
Three things changed in the last few years, and together they turned the cookie banner from a formality into something a reviewer signs off.
In the EU, the design of the banner itself is enforced. In January 2023 the European Data Protection Board’s cookie banner taskforce published the positions the national authorities had agreed after the wave of complaints about dark patterns. A banner with an accept button and no reject option on the same layer is, in the view of the vast majority of authorities, an infringement. Pre-ticked boxes on the settings layer do not produce valid consent. A reject option offered as a link where accept is a button, or button colours and contrasts that mislead, are assessed case by case, and the report lists examples that are manifestly non-compliant. There should be an easily accessible way to withdraw consent, such as a permanently visible icon or a link in a standard place.
In the US, the attention is on what fires behind the banner on health sites. In February 2023 the Federal Trade Commission took its first action under the Health Breach Notification Rule against GoodRx, over health information sent to advertising platforms through tracking pixels, and barred the company from sharing health data for advertising. In March 2023 it ordered BetterHelp to pay $7.8 million over the same pattern. In December 2022 the Department of Health and Human Services published a bulletin on tracking technologies for HIPAA-regulated entities, updated it in March 2024, and a federal court vacated part of it in June 2024. The rules are still moving, and a pharma site’s privacy counsel wants to see exactly what a visitor is shown and asked.
In California, there is a specific link to look for. A business that sells or shares personal information must put a clear and conspicuous “Do Not Sell or Share My Personal Information” link on its homepage, under Civil Code section 1798.135. On many sites that link opens the same preferences panel the cookie banner uses.
Add the ordinary reasons. The banner is copy: it makes claims about what the site does with data, and copy on a pharma site gets reviewed. It covers content: on a phone it can hide the ISI tray and the first screen of the page. And it is the one element that differs by region and by consent management platform release, so it changes without anyone on the brand team touching the site.
What a reviewer is checking
The list varies by team, but the questions come from the same sources.
- Is there a reject option on the first layer, as a button, with the same prominence as accept?
- On the settings layer, are the optional categories off by default?
- Does the banner say what it is for and how to consent, in language the legal team approved?
- Do the colours and contrast steer the visitor toward accepting?
- Is there a way to withdraw consent later, and where is it?
- Is the California opt-out link present, and where does it go?
- On mobile, does the banner cover the ISI tray or the first screen of content?
- After the visitor answers, does the page look and behave as reviewed?
None of these can be answered from a screenshot taken after the banner was dismissed.
The captures a reviewer needs
Four, on the landing page, at desktop and mobile widths.
- The banner as it first appears. Above-the-fold, before anything is clicked, so the reviewer sees the first layer exactly as a visitor does, including what it covers.
- The settings panel. The second layer, opened from the banner’s settings or preferences control, with the category toggles in their default state. This is where pre-ticked boxes and misleading defaults live.
- The page after the chosen consent path. The above-the-fold and full-page captures of the page itself should reflect one deliberate choice: reject-all, accept-all, or no answer. Record which.
- The withdraw affordance, if there is one. The floating icon or footer link that reopens preferences, on at least one interior page.
The banner belongs in the first two captures and nowhere else. If it appears in the full-page shot, either it was never dismissed or it came back.
Why it is awkward by hand
The banner behaves unlike anything else on the page, and every one of its habits works against a manual capture.
- It arrives late. Consent platforms inject their banner asynchronously, often a second or two after the page has finished loading. A screenshot taken on load can miss it entirely; a script that checks once and moves on does the same.
- You get one shot. The choice is stored in a cookie. Click anything and the banner is gone for that browser profile until the cookie is cleared. Capturing the settings panel after you have already dismissed the banner means starting over in a fresh profile.
- The settings control moves. Some platforms put the preferences link outside the banner container, in the footer, or behind a “Do Not Sell” link that is only rendered for certain regions.
- It fights other overlays. Age gates, HCP gates and site-entry modals stack on top of or under the banner, and a click meant for the banner lands on the gate’s backdrop.
- It renders differently on mobile. A bottom banner on desktop becomes a full-screen sheet on a phone, and the settings panel becomes a scrollable modal that can be taller than the viewport.
- It changes underneath you. A consent platform update or a region rule change alters the banner with no deploy on the site, so last milestone’s captures are not evidence for this one.
Doing it by script
If you automate this yourself, the things that matter:
- Poll for the banner for a few seconds after load rather than checking once.
- Find it by vendor first, then generically. The major platforms have stable container selectors. For anything else, look for a dialog role whose text mentions cookies, consent or privacy.
- Capture the banner, then the settings panel, then reload in a fresh context so the banner comes back before you take the dismissal path. Never dismiss first.
- Choose the path deliberately and try the vendor’s own reject or accept control before falling back to button text, then to a close control, then to Escape.
- Confirm it is gone before the above-the-fold and full-page shots, and re-check after any reload, because some platforms re-inject.
- Record the path on the output, because a reviewer comparing two capture sets needs to know both were taken the same way.
How RouteShot does it
RouteShot treats consent as a capture target on every job, on the landing page, before anything is dismissed.
- The banner and the settings panel are captured as their own artifacts, named consent-modal and consent-settings, at each viewport, before the dismissal path is taken. The settings capture can be turned off per project; the banner is always photographed when one is found.
- OneTrust, Cookiebot, CookieYes and Ketch are recognised by their own markup, including Ketch’s shadow-root rendering, with a generic fallback for any dialog that talks about cookies, consent or privacy. The engine polls for a few seconds because platforms inject late, and it records which platform it found on the job.
- The consent path is a project setting: reject (the default), accept, or none, which hides the banner without answering it so the rest of the capture represents a visitor who has made no choice. Vendor controls are tried first, then button text, then a close control, then Escape, and the engine confirms the banner is gone before the page captures.
- Gates are handled first. Age and HCP gates and site-entry modals are cleared before the banner is photographed and again after the reload, so a dismissal click never lands on a backdrop.
- On a multi-indication site, the section’s own landing page receives the consent captures on a scoped run, because that is the page the indication’s visitors land on.
What RouteShot does not do is audit which tags fire. It captures what the visitor is shown and asked, and records which answer was given. If your privacy team also needs a tag inventory, that is a separate tool alongside this one.
Before you submit
- Banner captured at both widths, before any click.
- Settings panel captured with defaults visible.
- Consent path chosen, recorded, and the same across the whole set.
- No banner in any full-page or above-the-fold capture of the page itself.
- Withdraw affordance captured, if present.
- California opt-out link present in the footer capture, if the site needs one.
- On mobile, a note on what the banner covered before dismissal.
If that list is clean, the privacy reviewer has what they need without asking for a second run.
Sources
- European Data Protection Board, Report of the work undertaken by the Cookie Banner Taskforce, adopted 17 January 2023. Paragraphs 8 (no reject on the first layer), 10 (pre-ticked boxes), 11 (link rather than button), 17 (colours and contrast), 32 (withdrawal).
- European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679.
- California Civil Code section 1798.135, the “Do Not Sell or Share My Personal Information” link.
- Federal Trade Commission, FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising, February 2023.
- Federal Trade Commission, FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising, July 2023.
- U.S. Department of Health and Human Services, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, bulletin of December 2022 as updated March 2024; part of the bulletin was vacated by a federal court in June 2024.
Written by the RouteShot Editorial Team from primary sources, cited inline. How we write and review guides · Report an error