How ConsentScan works
A cookie compliance scan should tell you what is firing, what it means under GDPR, and what to do about it. Here is what we look at, how the grade is applied, and where the scanner has limits.
What the scan does
Each finding is classified by purpose (analytics, advertising, personalisation, session replay, security, load balancing) and by who receives the data. Unknown first-party cookies are treated conservatively; unknown third-party cookies are treated with more caution, because they typically send visitor data to an outside company.
We also detect whether a consent management platform is in use and whether a consent banner is shown to a first-time visitor. Both feed into the result and appear in the report, together with the specific vendors involved and what to change.
What counts as essential
Under ePrivacy Directive Article 5(3), storing or accessing information on a user’s device requires prior consent. There is one exception: strictly necessary cookies for a service the user has explicitly requested.
- Session / login state
- Shopping cart contents
- Security tokens (CSRF, bot management)
- Load balancing
- User’s last-set language preference
- Analytics
- Advertising & retargeting
- Personalisation / A-B testing
- Session replay & heatmaps
- Third-party embeds that drop tracking
- Tag managers when they auto-fire trackers on load
How the grade is applied
We count the non-essential cookies and tracking embeds that fire before consent: none is an A, 1–2 a B, 3–4 a C, 5–6 a D, 7–9 an E, and 10 or more an F. Two things move a site down one grade. The first is sending visitor data to 5 or more third-party companies, or to 3 or 4 when the site would otherwise get a B or C. The second is having no consent platform at all, since there is then nothing in place to fix. A site whose Reject button doesn’t stop tracking gets an F, whatever its count.
What “Inconclusive” means
Some sites use aggressive bot protection that treats an automated browser differently from a real visitor and serves a stripped-down page with no scripts. The scanner sees no cookies and no CMP, which looks like a pass but usually isn’t. Rather than hand out a false A, we return Inconclusive with a warning. Paid plans include a verification token you can allow in your firewall, so scans of sites you own return an accurate result.
Known limits
The scan never clicks Accept. It checks what happens before a choice and after Reject. It doesn’t test what happens after acceptance, or whether consent is recorded and can be withdrawn properly.
The Reject check needs to find a reject or “necessary only” option. Unusual or heavily customised banners may not be recognised; when that happens, the result covers the before-consent check only.
Sites that keep most content behind a login, or only load trackers after complex user journeys such as checkout, may be under-reported.
The scan is a diagnostic aid, not legal advice. It flags observable behaviour that would concern a data protection authority; a lawyer needs to confirm compliance in your specific context.