Fixed-price audit

Consent Verification Report

We load your site three times: once clean, once accepting consent and rejecting it, and once with the Global Privacy Control signal set. Then we report what your trackers actually did, tracker by tracker, in a dated PDF your counsel or DPO can file.

Request a report Or scan it yourself with credits
$199
per domain, one off
  • Delivered in 2 business days
  • No subscription, no scan credits, nothing to cancel

The lead check

The Global Privacy Control check

A cookie banner is a consent interface. The Global Privacy Control signal is a legal instruction, and it arrives before any banner is clicked. Several US state privacy laws require a business to treat it as a valid request to opt out of the sale or sharing of personal information. California is the most explicit about it: Civil Code section 1798.135(b)(1), as implemented by 11 CCR 7025.

It is also the rare compliance duty that is testable from the outside. We send Sec-GPC: 1 on every request, set navigator.globalPrivacyControl for page scripts, reload the site, and compare it against the pre-consent baseline. The report names every advertising host that kept loading anyway, and separates the ones your own site is known to suppress when consent is rejected, because those prove the capability existed and was not used.

Your report also records whether the confirmation the California regulations ask for is displayed anywhere we could see it, and whether your published US Privacy or Global Privacy Platform string reflects the signal. Both are reported as observations rather than as verdicts, because a confirmation can live on a page we did not load.

An OnScanner Global Privacy Control result marked Needs review: the Sec-GPC header and navigator flag were sent, the privacy string stayed unchanged, the baseline and the GPC run each loaded 4 trackers and 2 cookies, and the per-tracker table shows every tracker still loading under GPC.

What you receive

What is in the report

Everything below is something the scan measures in a real browser on your live site. Nothing is inferred from your privacy policy or from a questionnaire.

Global Privacy Control

We load your site a third time with the Sec-GPC header and the browser flag set, then name every advertising host that kept loading anyway. This is the signal California, Colorado and Connecticut enforce, and the report gives you a dated verdict on it, with the per-tracker outcome, the US Privacy and Global Privacy Platform strings before and after, and whether the opt-out confirmation is displayed.

Accept all against Reject all

We click your banner both ways and diff the result: trackers, cookies and third-party cookies for each choice, then a per-tracker table of which hosts honored the rejection and which ignored it.

Firing before consent

We measure the page as it first renders, with your banner still showing, and name every advertising and analytics host that had already loaded. A tracker that loads before any choice is made had no consent to rely on, which makes this the check with the clearest legal exposure.

Tracker and pixel inventory

Third-party hosts grouped by the organization that owns them, plus the advertising pixels we see fire by name: Meta, LinkedIn, TikTok, X, Snap, Reddit, Pinterest and Google Analytics events.

Session recording and keystroke capture

Which session-replay services are running, and whether any script is listening to what a visitor types before they submit a form.

Fingerprinting

Canvas, canvas-font, WebGL and audio fingerprinting, the scripts doing it, the commercial fingerprinting services detected, and an entropy estimate for how identifiable the resulting fingerprint is.

Your consent platform

The consent management platform in use, the decoded IAB TCF string with its per-purpose consents, the tag-manager containers we find and the tags configured inside them.

Data leaving the page

Personal data seen in requests to third parties, first-party subdomains that resolve to a tracker, tracking parameters added to outbound links, and third-party scripts loaded with no integrity hash.

Then the part that makes it usable: a privacy score and grade, your privacy policy's disclosed third parties compared against the ones we actually observed, and a remediation note per finding. Dated, per-page, and yours to hand to counsel.

The OnScanner privacy checks grid for one site: 5 of 31 checks flagged, a Global Privacy Control result that needs review, 5 third-party tracker hosts, 10 Google Analytics requests, 10 beacon requests and 2 tracking cookies, with the other checks, from ad pixels and session recording to fingerprinting and personal data leaks, marked clean.

How it works

  1. You send us the domain and written authorization to test it. We do not scan a domain before that authorization is in writing, ever, and it has to come from someone able to give it.
  2. We run the audit in a real headless browser against your live site, sampling your landing page and internal pages, with a mobile browser profile.
  3. You get a dated PDF within two business days, with the per-tracker tables above and remediation notes on the gaps it ranks highest.

Who buys this

Privacy counsel, a DPO, or the marketing-operations lead who owns the tag manager. Usually because a banner was installed, signed off and never verified, and somebody now needs to know whether it does what it claims. It is also the right first step when a tracker showed up in a complaint, a questionnaire or a demand letter and nobody can say when it started firing.

If you would rather run it yourself and keep running it, the same privacy engine is in the product on scan credits, and continuous monitoring will re-check a domain and tell you when tracker behavior changes. This page is for the one-off deliverable with a price you can approve without learning a new unit.

What this is not

  • It is not legal advice. We report what your site did. Whether that breaches a particular statute is a judgement for your counsel, and the report is written to be handed to them rather than to substitute for them.
  • It is not a certification. This is a dated record of what your site did when we measured it, not a mark anyone accredits.
  • A crawl sees the pages it walked. We sample your landing page and internal pages, and the report says which URLs it covered. A tag that only fires at checkout, behind a login, or in a region we did not test is not in it.
  • A request to an ad host is not proof of a sale. Where the evidence supports a concern rather than a violation, the report says concern and says why. We would rather hand you a finding that survives a lawyer than a scary number that does not.

Questions

What is the Global Privacy Control signal?

A browser-level opt-out preference signal, sent as the Sec-GPC request header and exposed to page scripts as navigator.globalPrivacyControl. Several US state privacy laws require a business to treat it as a valid request to opt out of the sale or sharing of personal information. California is the most explicit: Civil Code section 1798.135(b)(1), as implemented by 11 CCR 7025.

Do I need a subscription?

No. The Consent Verification Report is a one-off deliverable at 199 USD per domain, priced outside the scan-credit system. There is nothing to cancel.

How long does it take?

Two business days from written authorization.

What do you need from me?

The domain, and written authorization to test it from someone able to give it. We do not scan a domain before that authorization is in writing.

More than one domain

Multi-domain and agency pricing is quoted per engagement, which is how this usually gets bought anyway. Tell us how many domains and whether you need one consolidated summary for the account or a separate report per site.

Get a quote Request a report