Cookie Consent Handoff: The Checklist Agencies Should Leave Behind
Most consent setups are installed by an agency, a freelancer, or a developer who then leaves. The banner keeps working, so nobody notices the handoff that never happened, until a regulator asks for records nobody can access, a new marketing tool fires untracked for six months, or the banner breaks in a redesign and the one person who knew the login is gone. Consent is not a launch task. It is a small ongoing system, and systems need owners, accounts, and instructions that survive the project team.
This checklist is what a responsible agency leaves behind at go live. Clients can also use it in reverse: if your agency cannot produce these items for a site they built, the handoff is incomplete and should be fixed while the relationship is warm.
Accounts and access in the clients name
The consent platform account, the tag manager, and the analytics properties should all be owned by the client, with the agency as an invited user rather than the account holder. Record where each login lives, who the administrators are, and how billing works when the agency is not paying it. Two client side administrators minimum, so one departure does not lock the company out of its own compliance tooling. This sounds basic, and it is the single item most often missing when a consent problem becomes urgent.
A dated cookie and tag inventory
Leave a scan dated within days of launch listing every cookie and tag, its category, its vendor, and whether it is blocked before consent. This document is the baseline every later change is judged against. Without it, nobody can tell whether a cookie found next year is new or was always there undeclared. Note also the deliberate decisions: which tools were removed rather than consented, and which jurisdictions the configuration targets, so a future editor understands the setup instead of just inheriting it.
The maintenance rhythm, written down
Consent decays through ordinary work: new tools, new campaigns, new pages. The handoff should state the rhythm that keeps it current, typically a rescan after every release that adds scripts, a quarterly review of categories and vendor descriptions, and a named person who owns the task. Include the test that matters, a clean profile decline test, in plain steps a non specialist can follow. A rhythm nobody wrote down is a rhythm that ends the week the project closes.
Records: where they are and how to produce them
Document where consent records are stored, how long they are kept, and the exact steps to retrieve the record for a given visitor, date, or complaint. Practice it once during handoff: pick a test choice, find its record, export it. If that exercise takes more than a few minutes or requires the agency, the record system is not yet handed over in any meaningful sense. Regulators and customers do not accept we would need to ask our developer as an answer.
Related reading
These earlier guides cover connected questions in more depth: Cookiebot Alternatives for 2026, White Label Cookie Consent: What It Is and How to Choose a Platform, and The consent pre-sales audit: what to check before you quote the project.
Frequently asked questions
Who should own the consent platform account, agency or client?
The client. The consent setup documents the clients legal compliance, and the records may be needed years after an agency engagement ends. Agencies should work as invited administrators, so access, billing, and records stay with the business that carries the obligation.
How often does a handed over consent setup need attention?
A rescan after any change that adds scripts or tools, and a review roughly quarterly even without obvious changes. Vendors update what their tags set, so a banner that was accurate at launch drifts. Quarterly checks keep the drift small and cheap to correct.
What is the most common handoff failure?
Access. The platform account sits under a departed developers email, nobody at the client can log in, and records cannot be produced. It surfaces at the worst moment, usually during a complaint, and it is entirely preventable with client owned accounts and two named administrators.
Should the handoff include testing instructions?
Yes, specifically the decline test: open the site in a clean browser profile, reject optional categories, and confirm no analytics or advertising requests fire. Written in plain steps, it lets any team member verify the banner still works after updates, without specialist tools.