How Much Does Your Consent Banner Weigh? Script Cost in Milliseconds

A consent banner is the one script on the page that cannot wait for permission. It has to load, check for stored consent, and render before anything else runs, because everything else depends on the answer. That makes it the most expensive script on the page by timing, even when it is not the biggest by size.

A CMP script that loads synchronously blocks rendering until it finishes, and the scan it runs, crawling the page for cookies and building a vendor list, runs on the main thread. The visitor sees a blank page while the banner decides whether to appear. That is the worst possible first impression, delivered by the tool meant to build trust.

The banner loads before consent, so it has to be light

A consent management platform does three things at load: it scans for cookies and trackers, it builds the vendor and purpose list for the banner, and it checks stored consent to decide whether to show the banner at all. The scan is the expensive part, and it is the part most sites run on every page load, even when the answer has not changed.

The vendor list matters here too. Under the IAB Transparency and Consent Framework 2.2, the list of vendors and purposes has to be current, and a CMP that rebuilds it from scratch on every load pays that cost on every page. A CMP that caches it pays it once. The difference shows up in the load time, and the visitor feels it before they read a word.

What the script actually does at load

Load the CMP script asynchronously so it does not block rendering, and defer the full cookie scan until after first paint. The banner can render from cached consent state while the scan runs in the background, and the vendor list can be cached rather than rebuilt on every page.

Google Consent Mode v2, mandatory since March 2024 for sites using Google Ads or Analytics, gives the mechanism for this: default-denied states let tags load in a restricted mode while the banner is still deciding, and the CMP updates the states when the visitor chooses. The tags do not wait for the banner. The banner does not wait for the scan. Both move, and the page paints.

Measure with the banner on, not off. A performance test that disables the CMP measures a site that does not exist, because every real visitor gets the banner. Interaction to Next Paint, INP, is the metric that matters: Google treats under 200 milliseconds as good and over 500 as poor, and a heavy banner script that runs on the main thread pushes INP up on exactly the pages that need it low.

Async, defer, and the scan you do not need on every page

Test on a real device, on a real connection, with consent cleared, because that is the state a new visitor arrives in. A returning visitor with stored consent gets a fast page. A new visitor gets the full scan, the full vendor list, and the full banner. The new visitor is the one whose first impression you are measuring, and the one most likely to leave.

Keep reading: Consent withdrawal in one click: the Article 7 test, Consent banners on subdomains: one banner or one per subdomain.

Measuring it honestly

Frequently asked questions

Why is a consent banner slow?

It has to load before anything else, check stored consent, scan for cookies, and build a vendor list, all before the page renders. A script that loads synchronously blocks rendering until it finishes, and the scan runs on the main thread.

How do I make a consent banner load faster?

Load the CMP script asynchronously, defer the full cookie scan until after first paint, and cache the vendor list instead of rebuilding it on every page. The banner can render from cached consent state while the scan runs in the background.

What is Google Consent Mode v2?

A mechanism that lets Google tags load in a restricted, default-denied state while the banner is still deciding, then updates the states when the visitor chooses. It has been mandatory since March 2024 for sites using Google Ads or Analytics.

What INP number should I aim for with the banner on?

Under 200 milliseconds is good and over 500 is poor, by Google's Core Web Vitals thresholds. Measure with the banner on and consent cleared, because that is the state a new visitor arrives in.