Consent & Tracker Regression Monitor — Before / Reject / Accept

Detect whether a website release changed consent behavior, trackers, third-party domains, or cookies.

What it does

For every URL, the Actor opens three fresh browser contexts:

1. Before consent — load the page and do nothing.
2. Reject all — load a clean session and attempt a deterministic Reject/Decline action.
3. Accept all — load another clean session and attempt a deterministic Accept/Allow action.

The first completed scan creates a baseline. Later runs compare the new three-state snapshot with the previous completed baseline and return machine-readable regression codes.

Why this is different from a cookie scanner

A one-time scanner tells you what exists now. This Actor is designed for release QA: what changed after your site was deployed?

Typical findings include:

• TRACKER_ADDED_BEFORE_CONSENT
• TRACKER_ADDED_AFTER_REJECT
• TRACKER_ADDED_AFTER_ACCEPT
• CONSENT_BANNER_DISAPPEARED
• new/removed third-party domains
• new/removed cookie names/domains

Input

{
  "urls": ["https://example.com/"]
}

Optional advanced controls bound navigation timeout, settle time and the number of recorded network requests.

Output statuses

• BASELINE_CREATED — first completed scan was stored.
• NO_MATERIAL_CHANGE — completed scan matches the previous baseline.
• CHANGES_DETECTED — one or more technical differences were found.
• SCAN_FAILED — at least one of the three isolated states could not be captured; the old baseline is preserved and the URL is not charged.

ACTION_NOT_FOUND is not automatically a scan failure. It means no deterministic Accept/Reject control was found on that page/state; the observation is returned as evidence.

Privacy and scope

This Actor stores cookie metadata only (name/domain/path/security flags), never cookie values. Request URLs are stored without query strings or fragments. It does not read form values or local/session storage.

This is technical regression evidence, not legal advice. It does not claim GDPR/CCPA compliance or non-compliance.

Pricing intent

PPE event: consent-regression-scan.

Target launch price: $0.05 per completed URL scan, subject to final Apify Cloud cost validation. Failed/incomplete URL scans do not call the PPE event.

Known MVP limitations

• Deterministic consent button matching; no AI vision fallback.
• Common Accept/Reject wording only.
• Small built-in list of high-frequency commercial trackers; raw third-party domains are always retained even when unclassified.
• No geo/proxy matrix in v0.1.