Cookie consent scanner

How the scan works

Playwright opens the homepage and stays there. We record document cookies, selected security flags (Secure, HttpOnly, SameSite), and third-party requests. Known analytics and ads hosts are flagged immediately. Leftover cookies and hosts get a typed classification; only a confident marketing label becomes a critical finding. Anything that appears before a consent click and is marketing is marked critical.

Cookies the vendor list does not know

A hardcoded host list goes stale. New CDNs, CMP vendors, and first-party analytics names show up as unknown. Complience.app keeps the known list in code, then classifies leftovers instead of pretending the list is complete. Uncertain leftovers stay unknown. That is not a CMP, and it is not a legal stamp.

What this is not

It is not a CMP. It does not generate a legally sufficient banner. It does not prove GDPR compliance. It is observable evidence you can send to a developer or a client: this tracker ran at 0ms.

The UK ICO’s cookies guidance says non-essential cookies should wait for a clear positive action. CNIL fined Google €325 million in September 2025 for cookie and advertising-consent failures (CNIL, 3 September 2025). A visible banner is not that test. The first-load log is. Read why a banner can still leak.

Pair the scan with the banner you already run

Keep the consent manager. Use this scan to see whether it held. These pages are not alternatives and not integrations. Nothing from Complience.app is injected beside their script.

• Complience.app and Cookiebot
• Complience.app and iubenda
• Complience.app and Termly
• Complience.app and Complianz

Why WAVE does not cover this

WAVE and Lighthouse score accessibility in the DOM. They do not sit in a clean browser profile and watch marketing cookies. Cookie evidence is the wedge if you already run those tools. WordPress sites often leak pixels through plugins; scan the public theme with the WordPress accessibility checker.