The cutover window is open. DNS is ready, the new analytics container is published, and the cookie banner looks identical.
Then someone asks for proof of a user’s consent from three months ago. Or they ask why a new CDN tag fired before consent.
A copied banner cannot answer either question.
Migrate legal and consent artifacts when changing analytics or hosts:
- Map old and new tags, cookies, vendors, purposes, and data flows.
- Decide whether consent must be renewed.
- Preserve records that can prove consent.
- Test blocking and Consent Mode.
- Keep a rollback plan.
Map consent before moving analytics or hosts
Map every old and new data flow before copying code. Then decide whether existing consent can remain valid.
Run the five reuse tests
Create a spreadsheet with one row for each old tool. Add one row for each replacement tool.
Add columns named purpose, data collected, recipient, controller, and transfer location. Mark each field as “same,” “changed,” or “unknown.”
This takes 10 to 20 minutes for each simple vendor. It takes longer when tags are hidden in checkout tools.
Reuse a prior choice only when every material field says “same.” A data controller decides why and how data is handled.
A data processor handles data under the controller’s instructions. A new processor may require updated contract and notice details.
A new independent recipient needs a stronger consent review. Think of it like changing both the courier and the delivery address.
Set renewal triggers now
Renew consent when you add advertising pixels or audience sharing. Renew it when you add behavioral profiles or new third-party cookies.
Renew it for a new vendor receiving event data. Renew it for new cross-border transfers or a changed controller.
Renew it when a purpose grows, such as ad personalization. The common mistake is treating a server-side tag as invisible.
Decision rule: Keep consent only when purpose, data, recipients, controller, and transfer path match. If one material item changes, show a new choice before new nonessential processing starts.
Your spreadsheet now sets the consent decision. Next, find the providers that receive data outside the visible page.
⚠️ Do not mark a field “same” because two services have similar names. Compare where each service sends data.
Audit host, CDN, and DNS data flows
List every infrastructure provider that can receive visitor data. Update the disclosures that describe those providers.
Inventory infrastructure processors
Open your hosting invoice and DNS zone. Then open the CDN, backup, and monitoring dashboards.
Add each company to a processor list. Record its service, region, data types, retention period, DPA status, and public subprocessor page.
This step often takes 30 to 60 minutes. Old backup accounts and error tools are usually the slowest part.
Include server logs, database backups, object storage, transactional email, error tracking, and support tools. Visitors do not see these services.
Still, an incident log can hold a full IP address. It can also hold a URL with an email, order number, or search term.
Check contracts and transfer paths
Download the DPA for each new processor. A DPA is the contract that sets processor data duties.
Save the version date in the migration folder. Check its data region, subprocessor list, breach notice terms, deletion process, and transfer method.
Transfer methods can include standard contractual clauses or the EU-U.S. Data Privacy Framework. Check the current provider terms, not an old sales PDF.
Update notices before traffic moves
Revise the privacy policy, cookie policy, and vendor disclosure. Use your processor list, not marketing assumptions.
State data categories, purposes, recipient categories, retention approach, and available user choices. Write these details in plain language.
A migrated banner must remain valid in every jurisdiction it serves. Its old appearance does not prove legal fit.
For GDPR-style rules, nonessential cookies usually need a free and specific choice before loading. The reject option should be as easy as acceptance.
Categories should not be preselected. For CCPA/CPRA-covered visitors, support applicable opt-out rights.
Those rights can limit sale, sharing, or targeted advertising. The California Attorney General explains these consumer privacy rights.
During a DNS move, test the banner on the new host. Test it through every CDN data flow too.
Cached banner code can show the wrong notice version. Geo-routing, language rules, and mobile layouts can also fire tags too early.
The provider list makes your notices match reality. The next matrix turns that list into launch rules.
⚠️ A CDN can cache an old banner after your policy changes. Purge relevant caches before final testing.
Build a tag and cookie purpose matrix
Build one release matrix that links every old script and cookie to its approved replacement.
Fill the release matrix
Open a private browser window. Accept all categories on the current production site.
Export a network HAR file from browser developer tools. A HAR file records browser requests, like a delivery receipt for each network call.
Review Google Tag Manager, page source, CMS plugins, and checkout integrations. Find what truly loads, not what someone remembers installing.
The most frequent error is checking only Google Tag Manager. Hard-coded scripts and vendor widgets often sit outside the container.
A purpose matrix links legal text to technical settings. It tells engineers which tags may fire.
It tells marketing what measurement remains available. It also tells privacy staff why each data flow exists.
| Old item | New item | Purpose and category | Launch rule |
|---|
| GA4 tag and _ga cookie | GA4 through GTM | Site measurement, Analytics | Block until required choice |
| Meta Pixel | Meta Pixel or CAPI | Ad conversion, Marketing | Renew if recipient or sharing changes |
| Host access log | New host log | Security, Essential | Set retention and disclosure |
| CMP preference cookie | OneTrust or CookieYes record | Store user choices, Essential | Preserve proof, minimize IDs |
Choose a CMP by migration needs
A CMP must export consent records and enforce regional rules. It must preserve retention settings and block managed and hard-coded scripts.
A lower monthly price is not cheaper if it fails these migration needs. Test exports before signing a new CMP contract.
| Option | Typical US cost | Migration fit | Check before launch |
|---|
| CookieYes paid plan | About $10 to $50 monthly | Small sites with simple categories | Export format and GTM blocking |
| Termly paid plan | About $15 to $60 monthly | Small US businesses needing notices | State rules and consent records |
| OneTrust | Custom annual quote | Complex multi-region environments | API exports, vendor controls, retention |
Record opt-outs and storage
Inventory browser cookies, local storage, consent strings, and server-side identifiers. Record duration, domain, and SameSite setting.
Also record first-party or third-party status. Record how withdrawal removes or disables each item.
A cookie choice without its removal path is incomplete. Test that path before you approve the release.
Consent migration release path
1. Inventory
Tags, cookies, hosts
2. Compare
Purpose and recipients
3. Decide
Reuse or renew consent
4. Test
No tag before choice
This matrix gives each team one shared release record. Now preserve proof without moving data you do not need.
⚠️ Do not assume a CMP blocks scripts from checkout apps. Test each third-party script in the browser.
Preserve proof without copying excess data
Export consent evidence into a controlled archive. Move only fields needed to prove each choice.
Export the minimum evidence set
Export the consent timestamp, choice status, and selected categories. Export the notice version, CMP version, and jurisdiction rule.
Include a reference that links back under controlled access. Record the export date, source account, and file checksum.
Also record the retention period and approved people. This work takes 15 to 30 minutes for one export.
Keep the historical file encrypted in a restricted archive. Do not keep it in a marketing drive.
Do not keep it in a shared analytics folder. Consent records are audit evidence, not a reason to copy raw event data.
Do not copy every IP address, device ID, or browsing history. Keep only what proves the user’s choice.
Separate current choices from history
Load current preferences into the new CMP only when the five reuse tests passed. Otherwise, start with no optional consent.
Show the updated choice on the first eligible page view. This is slower than copying all records, but it reduces risk.
An anonymous case is common: a site imports every old preference. Its new ad recipient then receives data without a new choice.
Your archive preserves the past without widening new processing. The final safeguard is proving tags stay blocked before launch.
⚠️ This method does not replace legal review for sensitive data, regulated sectors, or special contract duties.
Test blocking before the production cutover
Test the new stack in staging until no nonessential request appears before a valid choice.
Test each user choice
Use a clean browser profile for every scenario. Open browser developer tools and clear cookies and local storage.
Reload the staging URL. Inspect the Network, Application, and Console panels before clicking the banner.
Run and record these cases:
- No action after the banner appears.
- Accept all categories.
- Reject all categories.
- Analytics only.
- Marketing only.
- Withdraw after acceptance.
- Return after cookies are cleared.
For each case, save a banner screenshot and HAR file. Save stored cookies and the outbound-domain list too.
Testing only “Accept all” misses the highest-risk failures.
Validate consent mode signals
Check Google Consent Mode default values before optional tags fire. Confirm required values are denied by default.
Check analytics_storage, ad_storage, ad_user_data, and ad_personalization. Change only permitted values after a valid choice.
Google Consent Mode controls Google tag behavior. It does not block every third-party request by itself.
Set cutover and rollback criteria
Define failure conditions before launch. List any nonessential request before consent.
Also list a missing rejection record, wrong policy version, or broken opt-out link. Include an unavailable CMP or a processor missing from the notice.
If one occurs, restore the prior DNS or deployment version. Pause marketing tags until the issue is fixed.
Assign one rollback owner before the cutover window. A rollback without an owner often becomes a delayed debate.
⚠️ Do not test only “Accept all.” Rejection, withdrawal, ad blockers, and CMP outages expose the largest compliance gaps.
A clean staging result gives you evidence for launch. Keep that evidence with the consent archive and approval record.
Your questions answered
Can I keep cookie consent after changing hosts?
You can keep cookie consent after a host change only when five material factors remain unchanged. Check purposes, data, recipients, controller, and international transfers.
Review new logs, backups, CDN services, and subprocessors before deciding. A new provider can change processing even when the page looks identical.
Do I need to move old consent logs to my new CMP?
You should keep old consent logs as audit evidence, but you usually should not import every record. Move only current preferences that remain valid.
Archive older proof with limited access. Keep the archive separate from marketing data.
Does Google Consent Mode stop cookies before consent?
Google Consent Mode can control Google tags, but it does not automatically block every cookie or third-party request. Test hard-coded scripts, GTM triggers, and browser network calls.
A denied Google signal does not prove your entire site is blocked. Check the HAR file before launch.
What proves that consent records survived?
An export with timestamps, choices, notice versions, source details, and a file checksum gives usable migration evidence. Keep access controls and document the retention period.
Store the archive apart from marketing data. This helps show that historical proof was not reused for new tracking.
Do I need a new privacy policy after moving?
You need revised privacy disclosures when a host move changes processors, data locations, backups, CDN services, or data uses. Publish the update before new infrastructure gets public traffic.
A policy update should match the processor list. Do not copy language from a vendor’s generic template without checking it.
How much does consent migration usually cost?
A simple small-site consent migration often takes two to six staff hours. Complex multi-vendor work can take one to three business days.
CMP plans may cost about $10 to $60 monthly. Enterprise tools often use custom annual pricing.
What matters most:- Map actual scripts, cookies, processors, and transfer paths before moving production traffic.
- Reuse old choices only when the processing scope has not materially changed.
- Archive consent proof with minimization, access limits, and a retention rule.
- Use browser-level staging tests to prove optional tracking stays blocked until the visitor chooses.
- Keep a rollback owner and shared approval record for hosting, privacy, analytics, and legal teams.
