A cookie consent onboarding checklist for new client sites

New client sites arrive with unknown plugins, inherited tag managers, and years of marketing experiments layered on top of each other. Run this checklist before you promise the client they are compliant, because the banner is the last step, not the first.

Start with an inventory, not the banner

List every property the consent setup has to cover: the main domain, every subdomain, staging and development URLs that are publicly reachable, and the marketing landing pages hosted on other platforms. Note who has publishing access to the tag manager and the CMS, because you will need both before you are done.

Ask the client what changed recently. A redesign, a platform migration, or a new marketing agency almost always means new trackers. The client's memory is unreliable here, so treat the answers as leads, not facts.

Scan everything, then categorize

Run a full scan on each property, not just the homepage. Crawl the key templates: homepage, a content page, checkout or contact flow, and any page with embedded video or maps. Sort every cookie and tracker into four buckets: strictly necessary, functional, analytics, and marketing.

Flag anything unidentified. A cookie you cannot attribute to a tool is a risk the client is carrying unknowingly, and naming it in the report is part of the value you deliver.

Configure the banner and the blocking

Write the banner copy in plain language with genuinely equal accept and reject choices, and include a preferences panel where visitors can change their minds later. Then wire up prior blocking so analytics and marketing tags wait for consent instead of firing on page load.

This is where most inherited setups fail: the previous agency installed a banner but never connected it to the tag manager, so the banner collects choices that nothing respects.

Test like a visitor would

Open the site in a fresh browser profile, reject everything, and confirm no marketing requests fire. Accept everything in a new profile and confirm the expected tags do fire. Then revisit the preferences, change the choices, and confirm the site honors the update. Test on mobile too, where banners are most often broken.

Document and hand off

Give the client a one-page report: what was found, what was blocked, what is still waiting on their decision, and what they must tell you before adding new tools. That document is your paper trail when the client later asks why their new chat widget is blocked, and it is the reason clients keep the retainer.

Price the onboarding as its own line item

Agencies lose money when consent onboarding is bundled invisibly into a redesign or a monthly retainer. The work is real: inventory, scanning, categorization, configuration, testing, and documentation take days on a mid-size site. Price it as a fixed-fee onboarding project so the client sees what they are buying.

A fixed fee also sets the right expectation for what happens next. When the client understands that the initial cleanup was a project, they accept more easily that keeping it clean is ongoing work worth paying for.

Turn the checklist into a recurring service

The onboarding checklist does not expire after launch. Offer it as a quarterly re-run: rescan, re-categorize, re-test, and send an updated one-page report. Clients add tools constantly, and each addition is a small compliance risk they would rather you catch.

Recurring consent reviews are also the most natural upsell an agency has. The client already trusts you with the setup, the work is clearly valuable, and the alternative is the client discovering a problem on their own, which is how retainers end.