Paper consent ≠ browser behaviour
CMP dashboards list vendors. We show which domains still fire under Reject and granular choices.
Early accessSign-in is running on Clerk development keys. Live DPO accounts need production Clerk keys — this is not a silent configuration.
System status →Check what your website does after visitors click Reject.
Test consent choices, inspect browser evidence, and catch changes after releases.
No account required. Usually 5–12 minutes. Preview findings included; full reports on paid plans.
/scan — sample.example.com
SampleSample report chrome — illustrative, not a live scan of a named site.
Free check · paid monitoring
See it once on a URL you control
Full findings and a signed PDF on paid plans. Scheduling weekly re-scans is how you stop this being a one-off.
1 free scan per day without sign-up — preview scores and counts only. Full tracker evidence, plain-language report, and signed PDF require Starter or above. The free scan is one snapshot — paid tiers watch after you ship. Outputs are technical indicators for human review — not a compliance certification or legal advice.
01Who
Built for teams that must prove it
02The gap
CMPs collect. We measure the browser.
GTM can look fine and still fail
We score Consent Mode from the wire — not from the CMP admin alone.
Evidence is slow to assemble
Signed PDF + named hosts in minutes — indicators for counsel, not a legal verdict.
03What you get
Evidence you can hand over
01
8-session matrix
Accept, Reject, granular, withdrawal, GPC — named Reject-leak hosts on the wire.
02
Drift watches
Scheduled re-scans and agent alerts after GTM or CMP changes — so one clean scan is not the last word.
03
Consent Mode on the wire
Consent Mode signals from the browser, not the CMP admin alone. Interpret ad_storage with other CM flags.
04
Signed PDF
HMAC-SHA-256 pack for DPO / board handoff, with independent /verify.
Not a CMP, not a legal certification. Methodology & limits →
04In force
What is in force, and what is next
What is in force now, then what is coming next — so the calendar stays useful after headline dates pass.
- In forceSince 15 June 2026
ad_storage Ads gate
Google Ads uses ad_storage as the sole GA4→Ads gate. The job is to prove Reject actually updates Consent Mode on the wire — not that the banner exists.
- NextH2 2026
ad_personalization / ad_user_data
The remaining Consent Mode v2 parameters still decide remarketing and user-data sharing. Same scan; watch these once the Ads gate is clean.
- Then2026–27
DSA / AI Act evidence packs
Platforms need measured behaviour, not policy PDFs. The eight-session matrix is the evidence; undisclosed-AI signals stay a gate option, not a homepage product.
- Ahead2027
UK age-assurance duties
UK age-assurance and under-16 platform rules are rising. ConsentSignals Kids is an optional vertical when child-audience signals matter — consent verification stays the core product.