Two console tools confirm your install — one for what the CMP _intends_, one for
what actually _happened_.

## `debug()` — what the CMP intends

```js
LightningCMP.debug();
```

Prints a structured snapshot of the CMP's own decision-making: the resolved
regulation, current consent, Google Consent Mode signals, and a table of gated
scripts (blocked vs. activated, and why). Use it to answer _“why is this script
blocked, and what am I sending to Google?”_

It also raises **hints** — e.g. a `consentmode-order` warning if a site-hosted
Google tag beat the CMP's consent default, or a nudge to bridge a hard-blocked
Google tag. Enable verbose logging with `?lightning-debug` in the URL, or
`localStorage['lightning-debug'] = '1'`.

## Verify a GTM setup

If you use the [Google bridge](/integrations/bridges/#google-gtag--gtm):

1. Open **Preview** in Google Tag Manager and connect it to your site.
2. Check that the container loads, while tags requiring denied categories stay
   paused.
3. Change the banner decision, then confirm the matching tags fire after the
   corresponding Consent Settings are granted.
4. Run `LightningCMP.debug()` and check the Google signals and gated-script
   table alongside the GTM Preview timeline.

If GTM reports that a tag read consent before a default was set, the container is
probably being loaded separately from the bridge or an optimiser reordered the
head scripts. Return to [Choose your setup](/install/choose-setup/#google-tag-manager)
and [Troubleshooting](/guides/troubleshooting/).

## `audit()` — what actually happened

```js
await LightningCMP.audit();
```

A **behavioural** self-audit: it observes the cookies actually set and requests
actually fired on the page and infers whether any of it violated the visitor's
consent (a leak). Unlike `debug()`, it trusts nothing about config — it watches
real activity. The toolkit is lazy-loaded (`audit.js`) on first call.

A finding is a **leak** when a cookie or non-cookieless request fires under a
denied category, and **ok** when activity happens under a granted category (which
proves the CMP _gates_ rather than merely blocks) or is a designed cookieless
Consent Mode ping.

:::note[Blind spots]
The audit sees only first-party, JS-readable cookies and same-page requests.
HttpOnly/third-party cookies are invisible, and an ad-blocker can mask requests
entirely — these are surfaced as notes on the report.
:::