Methodology
Consent Check is an audit tool, not a consent manager. It never changes a site; it visits it with a real headless Chromium browser the way a fresh visitor would, records what happens, and compares that against each jurisdiction's rules.
Simulated location — real geo-IP egress not yet enabled. Each jurisdiction is emulated with its locale, timezone, Accept-Language and geolocation, but requests leave from the scanner's US data-center IP. Sites that pick their banner by IP address may show their US experience in every profile.
Checks
| Consent banner shown | Looks for known consent tools (OneTrust, Cookiebot, Sourcepoint, TrustArc, Didomi, Usercentrics, Osano, CookieYes, Quantcast and others) in the page and in consent iframes, then falls back to a heuristic: a fixed or dialog element that mentions cookies or consent and has buttons. |
|---|---|
| One-click reject on the banner | Searches the banner's first layer for Reject / Decline / Only necessary (and German, French, Spanish and Italian equivalents). In US profiles a “Do not sell or share” button counts as the opt-out control. |
| No trackers fire before consent | Records every network request on first load and matches it against tracker signatures (below). Under opt-in law, any transmission to a tracker before consent fails, including fetching the pixel script. A tag manager alone, or Google Consent Mode “denied” pings, is a warning. |
| No non-essential cookies before consent | Lists every cookie in the browser after first load and flags known analytics/advertising identifiers (_ga, _fbp, _gcl_au, IDE, _ttp, _uetsid, li_sugr, _hj…). |
| Reject / opt-out is honored | Clicks the reject control, waits for the network to settle, and fails if trackers fire or new tracking cookies appear afterwards. In US profiles only sale/share (advertising) tracking counts; analytics may continue. |
| Rejection persists | Reloads the page and follows a same-site link, then checks that tracking stays off. |
| Global Privacy Control honored | A separate fresh visit sends the Sec-GPC: 1 header and sets navigator.globalPrivacyControl = true. Fails in California and Colorado if sale/share trackers fire or advertising cookies are set. Requests that carry an explicit opt-out flag (US Privacy string, Google RDP) or only load a script are warnings. |
| Opt-out link | US profiles: looks for “Do Not Sell or Share”, “Your Privacy Choices” or opt-out wording. Required in California when sale/share trackers run; a warning elsewhere. |
Jurisdiction profiles
| Profile | Law | Regime | GPC required | Emulation |
|---|---|---|---|---|
| European Union Prior consent is required before non-essential cookies or trackers. Rejecting must be as easy as accepting, and a refusal must stick. | GDPR + ePrivacy Directive | opt-in | no | de-DE · Europe/Berlin |
| United Kingdom PECR requires consent before non-essential cookies or similar tech. The ICO expects a reject option as prominent as accept. | UK GDPR + PECR | opt-in | no | en-GB · Europe/London |
| California Opt-out regime: tracking may start before interaction, but a 'Do Not Sell or Share' (or 'Your Privacy Choices') link is required and GPC must be treated as an opt-out of sale/sharing. | CCPA as amended by CPRA | opt-out | yes | en-US · America/Los_Angeles |
| Colorado Opt-out regime for targeted advertising and sale. Since July 1, 2024 controllers must honor recognized universal opt-out mechanisms; GPC is on Colorado's recognized list. | Colorado Privacy Act (CPA) | opt-out | yes | en-US · America/Denver |
| Virginia Opt-out of targeted advertising and sale, disclosed in the privacy notice. The VCDPA does not mandate honoring GPC, so GPC results are best-practice only. | Virginia Consumer Data Protection Act (VCDPA) | opt-out | no | en-US · America/New_York |
| Other US states Baseline: privacy controls a site offers must actually work. Several states (e.g. Connecticut, Texas, Oregon, Montana, New Jersey) also require honoring universal opt-out signals; check the specific state. | Generic US baseline (state privacy laws + FTC Act §5) | opt-out | no | en-US · America/Chicago |
Tracker signatures
Meta Pixel (advertising) · Google Analytics (analytics) · Google Tag Manager (tag-manager) · Google Ads / DoubleClick (advertising) · TikTok Pixel (advertising) · LinkedIn Insight (advertising) · X (Twitter) Pixel (advertising) · Microsoft / Bing UET (advertising) · Microsoft Clarity (session-replay) · Hotjar (session-replay) · Pinterest Tag (advertising) · Snap Pixel (advertising) · Reddit Pixel (advertising) · Criteo (advertising) · Adobe Analytics (analytics) · Segment (analytics) · Amazon Ads (advertising) · Taboola (advertising) · Outbrain (advertising) · The Trade Desk (advertising)
What is real and what is simulated
- Real: the browser (Chromium), page loads, clicks on the site's own reject button, every network request, every cookie, screenshots, and the GPC header and JavaScript signal.
- Simulated: location. Locale, timezone, Accept-Language and geolocation are set per profile, but traffic leaves from the scanner's own data-center IP. Real geo-IP egress (proxies) is not enabled yet.
- Not covered yet: second-layer preference centers, consent strings (TCF/GPP) decoding, server-side tracking, mobile apps, logged-in pages, and sites that block automated browsers.
Automated technical checks for spot-checking only. Not legal advice; have counsel confirm any finding before acting on it.