Frequently asked questions
Everything you need to know about ConsentScan, GDPR cookie compliance, and what our grades mean.
What does ConsentScan actually check?
ConsentScan loads your website in a clean browser with no prior cookies or consent, then records every cookie set before any consent action is taken. It checks whether those cookies are strictly necessary (login sessions, shopping cart) or tracking/analytics cookies that require explicit consent under GDPR and the ePrivacy Directive.
Do you test the Reject button?
Yes, on every scan, the free one included. If the site has a consent banner, we choose Reject (or the “necessary only” option) and check the site again. If trackers keep setting cookies or loading after Reject, the button isn’t doing its job and the site gets an F, whatever else we found. If we can’t find a Reject option, the result says so and covers the before-consent check only. How the scan works →
How is the A–F grade calculated?
The grade starts from how many non-essential cookies fire before consent, then accounts for how many third-party companies receive data and whether you have a consent platform. See exactly how the grade is applied →
What if no consent platform (CMP) is detected?
It counts against your grade when tracking cookies fire: without a consent management platform (like OneTrust or CookieYes) visitors have no way to give or withdraw consent at all, which is a fundamental GDPR requirement. How the grade is applied →
How many pages does a free scan cover?
A free scan covers up to 13 pages, homepage included. The other pages are picked automatically and include contact, about and other commonly visited pages. Paid plans cover up to 51 pages per scan.
Is a B or C grade a legal problem?
It can be. A B or C still means some tracking cookies fired before consent, even if only one or two, and that is likely a GDPR and ePrivacy breach. Whether it leads to a fine depends on your jurisdiction, the nature of the cookies, and whether you can show you have fixed it. We strongly recommend consulting a privacy lawyer for a legal assessment.
Does the scan affect my website visitors or data?
No. The scan runs in a sandboxed browser on our servers and does not interact with your live visitor data. It simulates a brand-new visitor with no prior cookies or consent state.
I got an email report — what should I do with it?
Share it with your developer and your consent platform provider. The report lists every pre-consent cookie with the page it was found on and its risk level. Your developer and CMP provider should be able to use this to configure cookie blocking correctly.
What consent management platforms does ConsentScan detect?
ConsentScan detects 15+ CMPs including OneTrust, CookieYes, Cookiebot, TrustArc, Osano, Iubenda, Usercentrics, Didomi, Quantcast Choice, and more. If your CMP is not detected, let us know at info@consentscan.io.
What do paid plans add?
Paid plans add scan history, on-demand scans, PDF reports, WAF verification token, email support, MCP server (Pro+), priority support (Agency+), bulk upload (Agency+) and team members (Pro+). Coming soon: scheduled scans (Pro+), white-label PDF (Agency+), email alerts (Pro+), Slack alerts (Enterprise), REST API (Enterprise) and SSO & priority SLA (Enterprise). Compare plans on the pricing page →
How many free scans do I get?
One. Your first scan needs no account and no card: you see the grade, the counts and which vendors received data straight away. Create a free account to see the full report (every cookie, the page it fired on and the fix for each vendor) and get a copy by email. To scan more sites or rescan, choose a plan.