Tools / Cookies & Consent
What does your site do before anyone clicks accept?
A cookie banner is a promise that nothing non-essential happens until the visitor says so. Most sites keep it in the design and break it in the tag manager. Enter a site and this check loads it as a first-time visitor, clicks nothing, and lists every cookie set, tracker fired and third-party script loaded in that window, along with an inventory of every outside company the page brings in.
Cookies · Trackers · Consent platform · Third-party inventory · SRI · CSP · StorageFree · No sign-up · PDF report
What it checks
What happens before consent
The page is loaded in a real browser with a clean profile and nothing is clicked. Every cookie written, every request made and every storage key set in that window is recorded: that is what a visitor gets whether they accept or not.
Which of it needed consent
Cookies and hosts are matched against a catalogue of analytics, advertising, social, session-replay and marketing services. Under PECR those need consent first; fonts, CDNs, security and support tooling do not.
The consent mechanism
Recognises the common consent platforms (Cookiebot, OneTrust, CookieYes, Osano, Klaro and others), generic banners, and Google Consent Mode's default state, then checks whether the tags actually wait for it.
Third-party script inventory
Every host outside the site that the page references or contacts, what was loaded from it, whether it needs consent, and whether it fired before consent. The list a privacy notice and a supply-chain review both need.
Script integrity and policy
Cross-origin scripts checked for Subresource Integrity, and the Content-Security-Policy compared with the hosts actually used, so a script a CSP would block, or a CSP that allows everything, stands out.
Cookie hygiene and storage
Secure, HttpOnly and SameSite on each cookie, lifetimes that outlast any reasonable purpose, and what was written to localStorage and sessionStorage, which PECR covers in the same way.
Why this matters
The Privacy and Electronic Communications Regulations have required consent for non-essential cookies since 2011, and the ICO has spent the last two years writing to the UK’s most-visited sites about it, with the plain message that “reject all” has to be as easy as “accept all” and that the tags have to wait. What the regulator looks at is exactly what this tool looks at: a clean browser, a first visit, and the network tab before anybody has touched the banner.
The same list serves a different reader. Every third-party script on a page runs with the page’s privileges, can read what the visitor types, and is a supplier whose compromise becomes yours; the Magecart card-skimming campaigns worked by getting into exactly these scripts. Knowing what your site loads from whom, and pinning it with Subresource Integrity and a Content-Security-Policy, is the same inventory the privacy notice needs, seen from the security side. That is why the two checks are one tool.
Change the tag manager and run it again: the aim is a report where nothing that needs consent appears in the “before consent” column. The managed SOC runs this for clients daily and tells them the day a new third party appears on their site.
Also in Tools