What does your website do before anyone clicks “Accept”?
Paste a URL. A fresh browser opens it, sits still for 8 seconds, then accepts the cookie banner and keeps watching. You get a signed record of every tracker that loaded too early: named, timestamped, and checkable by anyone.
- 0.3 sGoogle Tag Managergoogletagmanager.comcontainer
- 0.9 sMeta Pixelconnect.facebook.net · sets _fbpbefore consent
- 1.4 sLinkedIn Insight Tagsnap.licdn.combefore consent
- 2.2 sHubSpotjs.hs-scripts.com · sets __hstc, hubspotutkbefore consent
- 4.1 sHotjarscript.hotjar.combefore consent
- 8.0 s · “Accept all” clicked
- 8.6 sMicrosoft Advertisingbat.bing.comwaited for consent
The same visit, twice.
Consent banners are supposed to hold trackers back until someone agrees. The only way to know whether yours does is to watch a first visit without touching anything.
Open it clean
A new browser profile with no cookies, no history and no ad blocker, connecting from an EU address, the way a first-time visitor would arrive.
Wait and watch
For 8 seconds nobody clicks, scrolls or moves the mouse. Every request and every cookie is recorded. Anything a tracker does now, it does without consent.
Accept, then compare
The scanner clicks the banner’s accept button and watches 5 more seconds. What appears only now was properly held back. What appeared earlier wasn’t.
A record you can hand to someone else.
Not a score, not a traffic light. A plain account of what happened, detailed enough that a developer can fix it and a DPO can file it.
- Every tracking vendor that loaded before consent, with the hosts it contacted and the cookies it set
- A screenshot of what the visitor saw at second 8
- What changed after the banner was accepted
- The raw request and cookie logs, gzipped JSON
- A receipt signed with our published key, so the record can be verified without trusting us
https://acme-saas.com/
Captured 14 October 2026, 14:02:11 UTC · Browser location: DE
| Vendor | Cookies |
|---|---|
| Meta Pixel | _fbp |
| HubSpot | __hstc, hubspotutk |
| Hotjar | _hjSessionUser_… |
Signature Ed25519 · 3f9c1a7e · verify at /verify
Built for the people who get asked “are we sure?”
Agencies and privacy consultants
Check up to 50 client sites every week. When a client’s marketing team publishes a tag that fires before consent, you get an email naming the new vendor, plus a signed record to send them instead of a screenshot.
Scan a prospect’s site before the first call. It makes a better opener than a slide deck.
See the Agency planIn-house marketing and privacy teams
Your consent banner says it blocks trackers. Every tag-manager publish, plugin update or new landing page can quietly undo that. A weekly check tells you when it happens, with evidence your DPO can file.
Wire it into CI with the API and catch it before release.
See StarterA screenshot proves nothing. A checksum proves little.
Screenshots can be edited, and anyone can recompute a hash after changing a file. Every record we produce comes with a receipt signed by an Ed25519 key we publish. A client, auditor or regulator can confirm the record is exactly what the scanner captured, and when, without an account and without taking our word for it.
How verification works →- A compliance verdict. We report what loaded. Whether it needed consent depends on things a browser can’t see.
- Legal advice. Take the record to someone qualified; it will make that conversation shorter.
- Another cookie banner. We check the one you already have.
Start free. Pay when it’s part of your routine.
Free
See what your own site does before anyone clicks.
- 3 on-demand scans
- 1 site checked monthly
- Signed PDF evidence report
- Public verification link
Starter
For one company that runs a consent banner and wants to know it works.
- 5 sites checked weekly
- 100 on-demand scans / month
- Email alert when a new tracker appears
- Signed PDF + raw evidence files
- API access
Agency
For consultants and agencies who audit client sites.
- 50 sites, daily or weekly
- 500 on-demand scans / month
- Drift alerts per client site
- Signed PDF + raw evidence files
- Priority queue
- API access
Scan pack
500 on-demand scans that never expire. No subscription.
- 500 scans (€0.05 each)
- Never expire
- API access
Prices in euros. EU VAT is added at checkout where it applies; our payment partner LemonSqueezy is the merchant of record and issues the invoice. Cancel any time; you keep your plan until the end of the paid month.
Before you ask
Can I scan a site I don’t own?
The free scan loads a public page exactly as any visitor’s browser does, so yes. Agencies often scan a prospect’s site before a first call. Scheduled monitoring is for sites you run or are authorised to audit for a client.
Where does the scanning browser connect from?
An EU data centre. Consent banners behave differently depending on where the visitor is, so the country is printed on every record.
My scan shows zero trackers. Am I compliant?
It means none of the advertising, analytics, social or session-recording vendors we recognise loaded in the first 8 seconds. That’s good news, not a certificate: tags can also fire after scrolling, on other pages, or for visitors from other countries.
What about Google Consent Mode?
Google tags in Consent Mode can send cookieless “denied” pings before consent. We list those separately and don’t count them as trackers, because whether they need consent is disputed. You get the facts and decide.
Is a tag manager loading before consent a problem?
Not by itself. It’s a container. We list it, and count only the tags it actually fires.
Is there an API?
Yes, on every plan: start a scan, poll for the result, download the PDF and the raw evidence. See the API reference.
What do you do with my data?
We keep your email address, the URLs you scan and the scan evidence, and nothing else. No analytics or advertising scripts run on this site. Scan it and see. Details in the privacy notice.
Find out in about 30 seconds.
Most people are surprised by at least one name on the list.