How a scan works, and what it can’t see

A record is only useful if you know how it was made. This page is the whole method. If something here is wrong or unclear, email us; we change the method in the open and version it.

1. The browser

• Chromium, headless, launched fresh for every scan: no cookies, no local storage, no cache, no extensions, no ad blocker.
• Language en-US, time zone Europe/Berlin, window 1440 × 900.
• Connects from an EU data centre. The country of the connecting IP is recorded on every scan, because consent tools decide what to show by IP location, not by time zone.
• Service workers are blocked so every request is visible. The browser may only reach public internet addresses.

2. The two windows

Window	What happens
Before consent 8 seconds	The page is opened (the clock starts when the HTML has loaded) and left alone: no clicks, scrolls, key presses or mouse movement. Every network request and cookie is recorded. A screenshot is taken at the end.
After consent 5 seconds	The scanner looks for the consent banner’s “accept all” button (known selectors for OneTrust, Cookiebot, Usercentrics, Didomi, Sourcepoint, TrustArc, Quantcast, Axeptio, Klaro and Google’s consent message, then button text in English, German, French, Spanish and Italian), clicks it, and records what happens next.

Eight seconds is a methodological choice, not a legal threshold. No regulation defines a waiting time. It is long enough for typical banners and tag managers to load, and short enough that nothing can be blamed on a visitor who stayed.

3. How vendors are identified

Each request host and each cookie is matched against a catalogue of about 130 vendors and 30 tracker-cookie patterns:

• By host, using the registered domain from the Public Suffix List (so snap.licdn.com is LinkedIn and shop.example.co.uk is example.co.uk).
• By cookie name, because many trackers write their identifier on the site’s own domain: _ga, _gcl_au, _fbp, __hstc, _hjSessionUser_* and others count as the vendor that sets them, not as “first party”.
• Requests to the site’s own domain (before and after redirects) are first party and not counted.

4. What is counted, and what isn’t

Observed before consent	Counted as a tracking vendor?
Advertising, analytics, marketing-automation, social-media and session-recording vendors	Yes
Google tags whose only traffic is Consent Mode “denied” pings (gcs=G100) and that set no cookies	No. Listed separately; whether they need consent is disputed
Tag managers (Google Tag Manager, Tealium, Adobe Launch)	No. A container isn’t tracking by itself; what it fires is counted
Chat widgets, video players, payment and scheduling tools	No. Listed as other third parties
Hosts not in our catalogue	No. Listed as unrecognised, never guessed
Consent tools, bot protection, CDNs, fonts, error monitoring	No

We would rather under-count than accuse a site of something we can’t name. Every record lists the uncounted categories too, so nothing is hidden.

5. Evidence and signatures

For each scan we store the full request log and cookie list for both windows (gzipped JSON, cookie values redacted), both screenshots, and the findings. A receipt lists the SHA-256 of each of those files, the scan settings and the browser location, and is signed with Ed25519. The public key is at /.well-known/cs-signing-key.json; see Verify a report.

6. Known limits

• One page, one visit. Trackers that fire on scroll, on other pages or after 8 seconds are not in the “before” window.
• Banners we can’t recognise aren’t clicked; the record then says so and has no “after” comparison.
• Sites can treat automated browsers differently, including blocking them.
• A vendor loading before consent is a fact about the page. Whether it was lawful depends on things a browser can’t see: legal basis, configuration, contracts. The record is evidence, not a verdict.

The SaaS study

We are re-running our study of 200 SaaS homepages from an EU location with this methodology. Our first run, in September 2026, came from a non-EU IP and counted every unrecognised host as a tracker; we don’t think those numbers are defensible, so we aren’t publishing them. The new results will appear here with the aggregate data.

Changes

2.0 (October 2026). Cookie-name identification; Consent Mode pings, tag managers and unrecognised hosts reported separately instead of counted; Public Suffix List for domains; browser location recorded; signed receipts.