Cookie consent leak audit: what fires before the visitor says yes
A cookie banner on the page is not the same as consent. We load your client's page in a fresh browser, touch nothing, and record every cookie set and every third party contacted before the visitor answers the banner. Then we press the banner's own Reject button, reload, and check whether the trackers actually stop. You get a plain-language report with the vendor, the evidence and the fix for each leak, ready to send under your agency's name.
On 6 agency homepages we scanned on 1 November 2026, 4 set or ran trackers that need opt-in consent before any choice was made, and on 3 of the 3 where we found and pressed a Reject button, consent-requiring tags still ran on the next page load. Names are withheld; the samples below are those real scans with the site's identity removed.
Scanned from a non-EU IP address with an honest automated user agent; see "Limits" below. Severity follows the general EU/UK rule (ePrivacy Art. 5(3), UK PECR reg. 6).
Before consent: every cookie (first and third party), localStorage key and third-party host in the first seconds, with no click, scroll or mouse movement.
After Reject: what still runs on the next page load once the visitor has declined. A Reject that does not stop tracking is the finding regulators care about most.
Classified, not dumped: each request and cookie is matched to a vendor and a category (advertising, analytics, session recording, visitor ID, social embed, IP transfer such as remote Google Fonts), from a tracker list we built from the vendors' own cookie documentation. Anything we cannot classify is listed, not hidden.
Google Consent Mode check: the Consent Mode default found in the page, and whether Google hits went out with storage denied.
Fix hints per vendor: e.g. GTM consent requirements, Consent Mode defaults, fbq('consent','revoke'), HubSpot's consent setting, self-hosted fonts, click-to-load embeds.
HTML and PDF, with your agency's name and logo on request.
Pricing
Product
Price
Consent leak report for one site: homepage plus up to 4 key pages (e.g. a landing page, contact form, blog post, shop page), before-consent and after-Reject
EUR 149
Monitoring: rescan of up to 10 domains every month, with a short email listing any new leak since the last scan (useful after a tag-manager change or a plugin update)
EUR 49 per month
How to order
Email datagleaner@gmail.com with the site URL(s), the pages you want covered, and your agency name and logo if you want it white-labelled.
We reply with an invoice (PayPal, or a card checkout link where available). Monitoring is invoiced monthly; cancel by replying "cancel".
The report arrives by email as HTML and PDF, usually the same day.
Not sure it is worth it? Email one URL and we will reply with the headline numbers for that page.
What this is not
Not legal advice, and not a compliance certificate. It is a technical record of what one browser observed. Whether a given cookie is lawful depends on its purpose, the country and the regulator's guidance; your client's privacy counsel decides that.
It cannot see server-side tracking, the banner's wording, the privacy notice, or what happens after a visitor accepts.
Vantage point matters: many banners geo-target. Our sample scans ran from an IP outside the EU/UK, and a banner may behave differently for an EU visitor. Each report states where it was run from.
Tags that wait for scrolling, a click or a second page view are not seen in the before-consent window.
We respect robots.txt and never get past anti-bot challenges; a site that blocks automated visitors is reported as not scanned, not guessed at.