How ConsentScan works
A cookie compliance scan should tell you exactly what is firing, what it means under GDPR, and what to do about it. Here is what we look at, how the grade is computed, and where the scanner has limits.
What the scan does
ConsentScan loads your homepage plus up to 12 internal subpages (50 for Pro) in a real headless Chromium browser — the same engine as Chrome. It waits several seconds for late-firing scripts, then reads the full cookie jar to see what was set before any user interaction. It never clicks Accept or Reject; the point is to see the default state a first-time visitor lands in.
Each cookie is classified against a rules database of 200+ known trackers (Google Analytics 4, Meta Pixel, TikTok, LinkedIn Insight, Hotjar, Clarity, DoubleClick, etc.) with a severity weight. Unknown first-party cookies are flagged as low-severity; unknown third-party cookies as medium.
The scanner also fingerprints the CMP in use across 15+ platforms (Cookiebot, OneTrust, Usercentrics, Didomi, iubenda, CookieYes, Termly, Osano, Ketch, TrustArc, etc.) via script tags, window globals, and localised banner text in seven European languages.
What counts as essential
Under ePrivacy Directive Article 5(3), storing or accessing information on a user’s device requires prior consent. There is one exception: strictly necessary cookies for a service the user has explicitly requested.
- Session / login state
- Shopping cart contents
- Security (CSRF tokens, WAF bot management)
- Load balancing (Cloudflare, Akamai, AWS ALB)
- User’s last-set language preference
- Analytics (GA4, Matomo, Plausible unmanaged)
- Advertising (Meta Pixel, Google Ads, LinkedIn, TikTok)
- Personalisation / A-B testing
- Session replay (Hotjar, FullStory, Clarity)
- Third-party embeds that drop tracking (YouTube default, unmanaged Google Fonts)
- Tag managers if they auto-fire trackers on load
How the grade is computed
The grade reflects both the count of non-essential cookies observed and the number of distinct third-party vendors receiving visitor data before consent. More vendors, lower grade — even at the same cookie count. If no CMP is detected at all, the grade is reduced by one band because there is no infrastructure to fix.
What “Inconclusive” means
Some sites use aggressive bot protection (Akamai Bot Manager, Cloudflare Super Bot Fight Mode, DataDome, PerimeterX) that fingerprints our headless browser and serves a stripped-down page with no scripts. The scanner sees no cookies and no CMP, which looks like a pass but usually isn’t. Rather than hand out a false A, we return Inconclusive with a warning. Pro users can whitelist a per-site verification header in their WAF to get past this.
Known limits
The scan currently checks only the pre-consent state — what fires before any interaction. It does not click Accept or Reject. This is the state most competitors measure, and it catches the vast majority of pre-consent violations. It does not catch the SHEIN pattern (a Reject button that pretends to work but still fires trackers); we intend to add that check.
The scan covers up to 13 pages on the free tier (51 on Pro). Sites that hide most content behind login walls or require complex user flows to trigger tracking scripts may be under-reported.
The scan is a diagnostic aid, not legal advice. It flags observable behaviour that would concern a data protection authority; a lawyer needs to confirm compliance in your specific context.