Checkout Sets Cookies Before Consent. That Is Where the Banner Fails.
On mobile, a consent banner is usually a bottom sheet covering the lower third to half of the viewport, exactly where thumbs, sticky add to cart bars, and chat widgets already live. If reject takes one more tap than accept on that sheet, or the sheet traps scrolling until a choice is made, the consent you collect on phones is the weakest consent you hold.
Checkout pages set cookies through payment providers, fraud checks, chat widgets, and embedded media, often before the visitor has consented to anything. A consent platform has to scan every template and flow that can set a cookie, including checkout and account areas, and block non essential tags there too. A scan that only reads the homepage describes a site that does not exist.
What checkout actually loads
A typical checkout loads a payment provider script, a fraud detection script, an address lookup, a chat widget, and sometimes an embedded video or social proof widget. Each of those can set cookies or local storage entries, and each of them loads on a page the visitor reaches after they have already decided to buy. The banner, if it appeared at all, appeared on the homepage several pages earlier.
The visitor's consent state has to travel with them. A consent cookie scoped to the wrong subdomain, or a consent platform that only runs on marketing pages, leaves checkout ungoverned. The result is a site that records consent on the homepage and ignores it where the money changes hands.
How to audit the flow properly
Run the scan logged in and logged out, on desktop and on a phone, and walk the whole purchase path: product page, cart, checkout, payment, confirmation, and account area. Use the tag manager preview mode and the browser network panel, and write down every cookie and storage entry that appears before consent, with the script that set it.
Compare that list against the cookie declaration the banner shows. Every entry on the network list that is missing from the declaration is a disclosure failure, and every non essential entry that fires before consent is a consent failure. The audit takes an hour; the gap it finds is usually the largest one on the site.
Fixing the order, not the copy
The fix is sequencing, not wording. Configure the consent platform to block the checkout scripts until consent is given, then test the purchase path again in the denied state and confirm the checkout still completes. Payment and fraud scripts that are strictly necessary for the service the visitor asked for do not need consent, but analytics and advertising scripts on the same page do.
Do not rewrite the banner copy first. Copy changes do not stop a tag from firing. The order is: block, test in denied state, confirm the purchase still works, then update the declaration so it matches what the site actually sets.
Keep reading: Consent Banners on Mobile: The Bottom Sheet Problem Nobody Tests, Records of Consent: The Fields You Will Be Asked to Produce, and Testing Consent Mode in the Denied State, Not Just the Granted One cover the nearby cases in this series.
Frequently asked questions
Do payment cookies need consent?
Cookies strictly necessary for the payment service the visitor asked for do not. Analytics, advertising, and personalization cookies on the same checkout page do, and they must not fire before consent.
Why do most cookie scans miss checkout?
Because they crawl public pages without logging in and without completing a purchase. Checkout, account areas, and embedded flows need a manual walkthrough with the tag manager in preview mode.
What if blocking a checkout script breaks payment?
Then the script was misclassified. Separate the strictly necessary payment and fraud scripts from the analytics and marketing scripts on the same page, and block only the second group.
Should the banner reappear on checkout?
No. The banner should appear once, on first visit, and the consent state should travel across the whole site, including checkout and subdomains. A banner that reappears at checkout is a scoping failure.