Install the new banner, then run a free scan of the page. The report shows every cookie, script and third-party request that fired before a first-time visitor clicked anything, split from what fired after, and whether "reject" blocked them. A banner that is installed but not wired to the tags is the most common thing we find, and it looks identical from the outside.
If the site uses Google tags, the same scan reads Consent Mode v2 off the network: the default state before the click and the update after it. That is the check that catches a template which loads gtag.js before the banner sets the default to denied.