Cookie Banner Not Showing: How to Find Out Why and Fix It

Why the banner seems to be missing

A consent tool has three jobs: load a script, decide whether this visitor needs to be asked, and draw the banner if they do. A banner can fail to appear at any of those stages, and only the first is a fault in the usual sense. The second stage is designed to hide the banner, for example when the visitor has already chosen or is outside the regions you configured.

That is why the first thing to establish is whether the banner is missing for everyone or only for you. Owners and developers are the people most likely to have accepted or rejected cookies already, to use a VPN, to run an ad blocker and to be logged in to the site, all of which can hide a banner that ordinary visitors see.

If you are unsure what the banner must do legally, the cookie consent guide covers the requirements, and the GDPR guide explains the wider rules.

The common causes

Work down this table in order. The first three causes account for most reports and take only a few minutes to rule out, while the later ones need DevTools.

How to test properly

Start from a clean state. Open a private window with no extensions, or clear the site's stored data: in Chrome DevTools open the Application panel, choose Storage and click Clear site data. Reload the page. Then test once more from a phone on mobile data with no VPN, which shows you roughly what a typical visitor in your country sees.

Look for the stored choice

Each tool remembers the decision in a cookie or in local storage. If one of these exists, the banner will stay hidden:

Check the script loaded

Open the Console and type the object name for your tool. If it returns undefined, the script never ran and you have a loading problem rather than a display problem:

typeof Cookiebot            // Cookiebot
typeof OneTrust             // OneTrust
typeof Shopify !== 'undefined' && Shopify.customerPrivacy   // Shopify
document.querySelectorAll('[id*="cmplz"], [class*="cmplz"]').length   // Complianz

Then open the Network panel, filter by the tool's domain, such as cookiebot or cookielaw, and reload. A request that is missing, cancelled or shown as blocked tells you where to look next. Red messages in the console that mention a Content Security Policy point straight at your headers.

Tool by tool

Complianz

Finish the setup wizard, then check the consent regions you selected. If you chose only the EU, visitors from the UK or elsewhere may not see a banner, depending on your settings. Complianz also lets you preview the banner from its settings screen, which helps separate a display problem from a loading one. Clear every cache after changing settings, because cached pages can carry old banner code.

Cookiebot

The banner only works on domains listed in the domain group for your Cookiebot ID. Add the bare domain, www, and any staging or alias addresses. Check the script tag is the first script in the <head>, especially in automatic blocking mode:

<script id="Cookiebot" src="https://consent.cookiebot.com/uc.js"
  data-cbid="00000000-0000-0000-0000-000000000000"
  data-blockingmode="auto" type="text/javascript"></script>

OneTrust

Changes to a banner or geolocation rule only reach the site after you publish the script for that domain. Check that the live site uses the production script ID and not the test version, which ends in -test. Geolocation rules decide which template, if any, each region gets, so a region set to no banner shows nothing.

Shopify

Open Settings, then Customer privacy, then the cookie banner settings, and check which regions the banner is shown in. If you also installed a consent app, decide which one you will use and switch the other off. The banner relies on the scripts Shopify adds to every theme, so a heavily edited theme.liquid that removed {{ content_for_header }} will break it along with much else.

HubSpot

Cookie banners are set per domain under the privacy and consent settings, and each banner can be limited to visitors from chosen countries. The banner loads through the HubSpot tracking code, so it will not appear on a page where that code is missing, such as a site template that was rebuilt without it.

Caching, optimisation and security policies

Performance tools are the most common reason a working banner breaks after a change. Features that delay JavaScript until the visitor interacts, combine scripts into one file or move them to the end of the page can stop a consent script running on time, or at all. In WordPress this includes the JavaScript delay and combine options in WP Rocket, LiteSpeed Cache, Autoptimize and similar plugins. On Cloudflare, Rocket Loader can do the same.

• Exclude the consent tool's script, by its file name or domain, from combining, minifying, deferring and delaying.
• On Cloudflare, either turn off Rocket Loader or add data-cfasync="false" to the consent script tag so Rocket Loader leaves it alone.
• Clear the plugin cache, any server cache and the CDN cache, then test again in a private window.

The WordPress JavaScript guide explains how deferral and delay settings work if you need to tune them without losing speed.

Content Security Policy

If your site sends a Content-Security-Policy header, it must allow the consent tool's domains. A policy that does not will block the script silently from the visitor's point of view. For example:

Content-Security-Policy: script-src 'self' https://consent.cookiebot.com https://consentcdn.cookiebot.com;
  connect-src 'self' https://consentcdn.cookiebot.com

OneTrust needs https://cdn.cookielaw.org, and https://geolocation.onetrust.com if you use geolocation rules. Check your tool's documentation for its full list. The WordPress security headers guide shows where the policy is usually set.

A worked example

A Shopify store owner in Manchester reports that the cookie banner has disappeared. In a private window the banner still does not show, so a stored choice is not the cause.

1. In Shopify, the customer privacy settings show the banner limited to visitors in the EU and UK, which is correct for the shop.
2. The owner remembers their laptop is always connected to a VPN, and checks the exit location, which is in the United States.
3. Testing from a phone on mobile data with the VPN off, from a UK connection, shows the banner straight away.
4. While checking, they find a consent app installed months earlier that also tried to show a banner. They remove it so only one tool controls consent.

Nothing was broken. The test was simply made from a region where the banner was not meant to appear, and the second app was a problem waiting to happen.

The fix, step by step

Edge cases worth knowing

• Logged-in users. Some setups skip the banner for administrators or logged-in customers. Always test logged out.
• Banner shows on desktop only. A mobile menu, chat widget or sticky footer can cover the banner, or theme CSS can hide it at small widths. Test on a real phone, not only a resized desktop window.
• Banner flashes then disappears. Usually two tools, or a script that reads an old stored choice after the banner has drawn. Remove the duplicate tool and clear stored data.
• Single-page applications. If the site swaps pages without a full reload, check the consent script is included once in the outer layout, not inside a component that is replaced.
• Tags firing while the banner is missing. Check that analytics and advertising tags wait for consent. The ePrivacy tracking guide shows how to confirm nothing is set before the visitor chooses.

Keeping the banner working

Banners tend to break when something around them changes: a new caching plugin, a theme update, a new domain or a new security header. A few habits catch problems early:

1. After any change to caching, optimisation, themes, domains or headers, test the banner in a private window and on a phone.
2. Keep one consent tool, and document which one it is, so nobody installs a second.
3. Add new domains, including staging and campaign sites, to the tool's allowed list before launch.
4. Check your Reject option is as easy to use as Accept, and that your privacy policy describes the cookies the banner lists.

The full list of GDPR fixes covers the related consent and policy problems audits find.