Your site is sending data your visitors said no to.
Law firms are suing retailers under California’s wiretap law for exactly this, at up to $5,000 per violation. Consentinel loads your site twice, once refusing consent and once accepting it, and shows you every tracker that ignored the difference.
Free. No account. Results in about a minute.
A cookie banner isn’t compliance.
Most sites that get sued have a banner. The banner isn’t the problem. The tags behind it are.
$5,000
Statutory damages per violation under California’s wiretap law (CIPA). The plaintiff doesn’t have to prove harm.
$1.2M
Sephora’s fine from California’s Attorney General for ignoring Global Privacy Control opt-outs.
$1.55M
Healthline’s fine for trackers that kept firing after visitors opted out.
Evidence your counsel can use.
Every finding carries the exact request or cookie that proves it. Fix it before a demand letter shows up, or show you already did.
2
page loads per scan. One refusing consent, one accepting it. The difference between them is the entire finding.
Trackers that ignore consent
Tags that load and send data while consent is refused, including ones that read the denied signal and fire anyway. This is the core of most wiretap claims.
Personal data in plain sight
Email addresses and other identifiers passed to ad and analytics platforms in query strings. That’s a data leak, not a tracking setting.
Scripts nobody approved
Third-party scripts on payment pages with no record of why they’re there. PCI DSS 4.0.1 requires an inventory of every one, and a missing script can fail your audit.
Clean today. Broken next week.
Your marketing team adds tags all the time, and each one can break consent again. Monitor rescans your site daily and emails you the moment something new starts firing. $99/month per site, less than an hour of outside counsel.
Jira integration
Close the ticket. We check the fix.
Every new critical finding opens a Jira ticket with the evidence and the fix. When someone moves it to Done, Consentinel rescans your site and posts the verdict on the ticket. Nothing closes on a fix that didn’t ship.
Tickets open themselves
A tracker that starts firing after opt-out becomes a ticket in your project, with the vendor, the proof and the fix. Nobody copies findings out of a report.
Done means rescanned
Moving any ticket to Done triggers a fresh scan. A release that breaks consent gets flagged on the ticket that shipped it, not weeks later.
A record that holds up
Each verdict is a dated comment on the ticket: what fired, when it was fixed, and the scan that proves it. That’s what counsel and PCI DSS 11.6.1 reviews ask for.
Works with Jira Cloud in about two minutes. Alongside email and Slack alerts, on Growth and Agency. See plans →
See what your site is sharing.
Scan any page you own. You’ll get the headline immediately and the full report by email.
Free. No account. Results in about a minute.
Not fixed. 1 of 2 findings still fires after opt-out: Meta Pixel. Reopen this ticket.