Toolkit
Cookie Consent Check
What your site sets before anyone clicks accept. The rule is that non-essential cookies need consent first, and the usual failure is a banner announcing cookies that have already been set.
What this can and cannot see. It requests your page once, with no cookies and no clicks, and reports what your server set and what is present in the HTML it returned. That is exactly the state a first-time visitor is in before consenting to anything. It cannot see scripts injected later by a tag manager, so a clean result here means your server is clean, not that your site is. For the full picture you need a browser-based audit.
A banner is not consent
This is the distinction that decides most enforcement. Consent has to be given before the cookie is set, freely, and it has to be as easy to refuse as to accept. A banner that appears while analytics has already fired has notified someone about something that already happened.
In practice the fix lives in your tag manager rather than in your banner. Tags fire on a consent event instead of on page load, and the banner updates that consent state. Most sites that fail this installed a compliant banner and never changed the trigger.
The limit of a server-side check
Worth repeating because it matters: this reads one response without running JavaScript. It reliably tells you what your server set and what is hard-coded in your HTML. It cannot see what a tag manager injects afterwards, so treat a clean result as one useful data point rather than a clean bill of health.