The agency's cookie-consent launch checklist: 10 checks before handover
A client should not discover their cookie setup is incomplete when the first campaign goes live. The launch handover is where you make the setup understandable, testable and someone else's responsibility to maintain.
Passiro
Placeholder[PUBLICATION DATE: set when published]
A useful cookie-consent checklist covers the visible banner, the underlying tools, the conversion journey and the evidence you hand over. It should also name the person who reviews future changes. Installing a plugin is only one item.
This checklist is for agencies delivering SMB websites. Use it alongside the client's agreed regional and legal requirements rather than treating it as a certification.
1. Agree the markets and the data uses
Ask the client where they market, which services they use and what they intend to measure. Record the decisions behind regional banners and defaults. “We are based in the US” is not a complete brief if campaigns target European customers.
Use our EU and US consent guide to structure that conversation.
2. Inventory the tools and their installation routes
List analytics, ad pixels, videos, maps, chat and booking services. Identify whether each comes from a plugin, theme, direct code, tag manager or server-side integration.
Do this before launch day. The forgotten widget usually takes longer to investigate than the banner takes to style.
3. Review the copy with the actual website in mind
Check that the banner describes the real purposes and links to the right information. Remove references to tools the client no longer uses. Confirm that the preference categories mean the same thing to the client and the implementer.
Avoid copying policy text from another client's site. Similar websites can use different vendors and data flows.
4. Check the design on mobile
Verify readable text, usable buttons, visible keyboard focus and an accessible settings route. Ensure the banner does not hide a checkout control or a form submission button.
For design review, use our six layout examples and dark-pattern checklist. Keep the functional choices intact when adapting the colours.
5. Test the initial state
Use a fresh session and inspect the relevant storage and outgoing requests before making a choice. Confirm that the initial state matches the agreed setup, including the chosen Google Consent Mode implementation.
Save the result and the test conditions. “Looks fine on my laptop” is difficult to investigate after a later release.
6. Test each choice and withdrawal
Check rejection, acceptance, category-specific permission and withdrawal. Navigate after each choice and exercise the tools involved.
Keep the test record short: expected result, actual result, affected tool and issue owner. The four-state test gives your technical colleague a repeatable sequence.
7. Complete a real conversion journey
Submit a test lead or complete an approved test order. Check the event name, destination, value, currency and duplicate prevention where relevant. Include mobile and any cross-domain checkout.
Use Google's Tag Assistant troubleshooting guidance for consent signals, while checking non-Google tools separately. A successful page-view event does not prove that the final conversion works.
8. Check the scan coverage
Review the initial findings, correct misclassifications and identify pages that need manual testing. Confirm the plan's page allowance and scan frequency against the client's site.
If the site has 2,000 pages, do not hand over a 500-page scan as though it covered all of them. Explain which sections were inspected and how the remaining risks will be reviewed.
9. Hand over access and evidence
Give the client the access they need without sharing personal credentials. Include the relevant configuration, test results, installation locations and instructions for changing preferences or reviewing records.
Explain retention and export allowances. If the client needs records covering a specific period, establish that the selected plan supports the requirement before they need the export.
10. Assign ongoing ownership
Name who reviews scans, approves new tracking tools and retests after website changes. State what the agency's ongoing service includes and what the client owns.
A practical handover note can be one paragraph: “Marketing owns the vendor list. Development owns tag behaviour. The website owner reviews scan findings monthly. A new pixel, checkout or chat tool triggers a consent test before release.” Adapt the roles to the actual agreement.
Keep the software bill proportionate
Passiro Free includes unlimited visitors, team members and centralised multi-site management, plus monthly scans of up to 500 pages per domain. Paid plans are priced per domain and add defined capabilities. Review the plan overview when scoping the project.
Your agency can charge for real work such as implementation and maintenance. Be clear about that service and distinguish it from the software subscription.
One quick question
Is the client automatically compliant after the handover?
No. The checks help establish and document the setup. Applicable requirements, future website changes and the client's data practices still need an owner.
Give clients a better deal on cookie consent and a handover they can use. Get Started.