Consentinel

We don’t ask your site. We watch it.

A consent banner records a choice. It doesn’t prove anything was honored. Consentinel loads your site twice, under two different answers, and reports every difference between what you promised and what actually happened.

The two-pass scan

Your banner records a choice. We check whether anything listened.

  1. 1

    Refuse

    A real browser loads your page, clicks reject, and records every request and cookie.

  2. 2

    Accept

    Same page, same browser, the opposite answer. Recorded again.

  3. 3

    Compare

    Firing both times means it ignored the refusal. Firing only after accepting means it waited, and we say so by name.

Every finding carries its proof.

We don’t report that something "may be" firing. Each line comes with the exact request or cookie that caused it, so the person who has to fix it can verify the claim in their own devtools in under a minute.

That matters when the report leaves your desk. Evidence survives being forwarded to a developer, an agency, a lawyer, or an auditor. An opinion doesn’t.

One tag can bring eight more.

Ad tags rarely travel alone. One pixel loads a sync frame, the frame calls a dozen partners, and each partner sets its own cookies. Fix them one at a time and you will be chasing symptoms.

Consentinel traces every tracker back to the tag that loaded it. On one real store, a single advertising tag was responsible for nine findings, so the report puts that one fix first.

What we grade, and how

Every non-essential tag that fires before consent is a violation. They’re not equally urgent. If everything is critical, nothing is, and the report stops helping you decide what to fix first.

Critical

Advertising and session recording. Data leaves for profiling, cross-site targeting, and resale. Personal data sent to a tracker in plaintext. A tag that saw a denied consent signal and fired anyway.

Warning

Analytics, tag managers, and social embeds. Still unlawful before consent, lower exposure, and usually a one-line Consent Mode fix rather than a rebuild.

Never flagged

Payment processors, bot protection, and strictly necessary cookies. These are lawful before consent. Flagging them would be crying wolf, so we recognize them and stay quiet.

Scans that follow your releases.

Most consent breaks ship with a release: a new tag, a theme update, an app install. Every monitored site gets a private URL that runs a scan the moment you deploy. If a release breaks consent, you get the alert within minutes, not at the next scheduled scan.

- name: Consent scan after deploy
  run: curl -fsS -X POST "${{ secrets.CONSENTINEL_DEPLOY_HOOK }}"

One step after your deploy in GitHub Actions. Works the same from any CI system, Shopify Flow, or Zapier: it’s a single HTTP POST.

What we don’t do

Every tool in this category publishes what it catches. Here is what ours misses, because you should know before you rely on it.

  • We can’t always find your reject button. If your consent platform is custom or unusual, we may not be able to click refuse. When that happens the scan runs in the banner's default state instead, and the report says so, because "before any choice was made" is weaker evidence than "after refusing" and shouldn’t be presented as the same thing.
  • Some sites refuse us. Enterprise bot management can reject an automated browser outright. We would rather fail loudly than return a clean report we didn’t earn.
  • We can’t attribute every cookie. Real sites set cookies we don’t recognize. We list them separately as evidence rather than counting them as findings, because we can’t prove they’re non-essential and guessing would waste your time.
  • A scan is a moment, not a guarantee. A clean scan today says nothing about the tag someone adds on Thursday. That’s what monitoring is for.

Point it at a page you own.

The free scan takes about a minute and needs no account.

Free. No account. Results in about a minute.

Monitoring runs the same scan on a schedule and after every deploy. See pricing