GDPR Cookie Consent Verifier: cookie consent checker with before / reject / accept evidence

Check whether a GDPR cookie banner really works. The test is modelled on the before / reject / accept method EU data-protection authorities use in cookie-banner investigations: each page is loaded in three fresh browsers, before any choice, after Reject and after Accept. You get cookies, localStorage items and tracker requests per state, seven pass / warn / fail checks, fix hints and an HTML and PDF report in English or Dutch.

No subscription, no auto-renew, no domain or page-view tiers. $0.10 per page checked, $0.50 per site report.

Use cases

• Agencies and freelancers: check a client's banner after every CMP or tag-manager change and attach the PDF.
• Small e-commerce and SaaS teams: confirm Reject really blocks analytics and marketing tags, then monitor weekly.
• Privacy consultants and DPOs: collect consent verification evidence for many sites before manual review.
• Developers and analytics teams: check Consent Mode v2 from CI, n8n, Make or Zapier.
• Dutch market: reports in Dutch with references to the Autoriteit Persoonsgegevens' guidance ("Heldere cookiebanners").

Sample output (shortened, real run on our demo shop):

{
  "type": "page",
  "url": "https://cookie-demo.mateuscorreia.com.br/",
  "verdict": "fail",
  "visitorCountry": "NL",
  "checks": {
    "no-tracking-before-consent": "fail",
    "no-tracking-after-reject": "fail",
    "reject-as-prominent": "warn",
    "no-pre-ticked-boxes": "fail"
  },
  "counts": { "nonEssentialCookiesBeforeConsent": 2, "nonEssentialCookiesAfterReject": 2 }
}

This is an automated technical test, not legal advice. Findings are worded as potential issues. Results depend on location, browser, timing and A/B tests. Have a privacy professional confirm important findings.

What does the GDPR Cookie Consent Verifier do?

• Three fresh browser sessions per page, so nothing leaks between states. The before state is measured on first load; Reject and Accept are measured after a reload, when many tags fire.
• Detects the consent platform (CMP): Cookiebot, OneTrust, Complianz, CookieYes, Didomi, Usercentrics and 12 more, plus custom banners, inside iframes and shadow DOM too.
• Finds the buttons by label in seven main EU languages and by known CMP selectors, or by your own CSS selectors.
• Classifies cookies with the Open Cookie Database and tracker requests with EasyPrivacy.
• Decodes Google Consent Mode v2 (gcs / gcd), so a "denied" cookieless ping is a warning, not full tracking.
• Monitor mode outputs only pages that changed since the previous run.
• Several sites per run, with a combined report and site summaries. Export to CSV, Excel or JSON.

The seven checks

Check	What fails it	Based on
banner-present	Tracking seen but no consent banner found	ePrivacy Directive Art. 5(3)
no-tracking-before-consent	Analytics/marketing cookies or tracker requests before any choice	ePrivacy Art. 5(3), EDPB Guidelines 2/2023
reject-on-first-layer	"Accept" on the first layer but no equivalent "Reject"	EDPB Cookie Banner Taskforce report §3
no-tracking-after-reject	Tracking cookies or tracker requests still present after "Reject"	ePrivacy Art. 5(3), EDPB 05/2020, Taskforce §8
reject-as-prominent (heuristic, warn only)	Reject clearly less visible than Accept	Taskforce §5–6
no-pre-ticked-boxes	Non-essential purposes switched on by default	CJEU C‑673/17 Planet49, Taskforce §4
consent-mode-v2	Google tags "granted" before consent (fail); missing v2 signals or still "denied" after Accept (warn)	Google EU user consent policy (Google policy, not law)

A warn marks findings that need judgement, such as cookieless pings or unclassified third-party cookies. n/a means a check did not apply, for example consent-mode-v2 when no Google tags were seen. A page that could not be loaded gets n/a as its verdict.

Location matters. If visitorCountry is outside Europe, every fail becomes warn, because many CMPs only show a banner to EU visitors.

Input

Field	Description	Default
startUrls	Pages to check. URLs on one domain are grouped as one site.	–
maxPagesPerSite	Pages per site; extra pages are found via links on the first page	1
proxyConfiguration	Use an EU country: banners are often geo-targeted	Apify residential, NL
locale	Browser language and region (nl-NL, de-DE, en-GB, …)	nl-NL
language	Report language: en or nl	en
generateReport / generatePdf / includeScreenshots	HTML report, PDF copy, banner screenshots	true
monitorMode / monitorStoreName / webhookUrl	Output only changes since the previous run with the same store name; optional webhook	false
customBannerSelector, customAcceptSelector, customRejectSelector, customSettingsSelector	CSS selectors for banners the detection misses	–
viewport	desktop (1366×900) or mobile (390×844)	desktop
blockImagesAndMedia, maxConcurrency, pageTimeoutSecs	Advanced. Tracker images are never blocked.	true, 2, 45

Try it on the demo shop. The prefilled URL, https://cookie-demo.mateuscorreia.com.br/, is a fictional shop with a deliberately non-compliant banner: cookies before consent and after Reject, a small grey Reject link and pre-ticked options. Its /compliant page passes every check. No real tracking services are loaded.

Output

Dataset: one row per page (type: "page") plus one per site (type: "site-summary"). Page rows also contain cmpVendor, checkDetails (evidence, fix and references per check), banner, consentMode and states.before / reject / accept.

Key-value store: report.html, report.pdf, banner screenshots, SUMMARY and OUTPUT.

Schedule recurring consent checks

Consent often breaks after launch, when someone adds a pixel or a CMP update changes a trigger.

1. Save your sites and settings as an Apify Task, one per client with its own monitorStoreName.
2. Turn on monitorMode and, optionally, set webhookUrl.
3. In Apify Console, open Schedules and add the task with a cron expression, for example 0 8 * * 1 for Mondays at 08:00.

The first run is the baseline: every page comes through as changeType: "new" and is sent to the webhook. After that, each run outputs only pages that changed, with a changes list, and the webhook fires only when something changed. See Apify schedules.

Use it from n8n, Make and Zapier

Apify has official integrations for all three. Connect your Apify account with an API token, then use the Apify app or node to run an Actor or Task and fetch its dataset items, or start a workflow when a run finishes.

Typical workflows:

• Alert on a broken banner: schedule a run with monitorMode off, so every page is in the dataset, then filter page rows with verdict: "fail" and post them to Slack or email. (With monitorMode on, a page that keeps failing is not output again.)
• Ticket on change: create a Jira or Trello card for each row with changeType: "changed", with the report link from OUTPUT.

Guides: n8n, Make, Zapier.

Pricing (pay per event)

Event	Price
Page checked (page-checked), three browser sessions per page	$0.10 per page
Report generated (report-generated)	$0.50 per site report (HTML + PDF)

Examples: one homepage with a report costs $0.60. 20 sites × 3 pages with reports cost $16.00. A weekly check of one homepage with a report costs about $2.60 a month.

Failed pages are not charged. Set Maximum cost per run to cap spend; the Actor stops cleanly at the limit.

FAQ

Does a pass mean my site is GDPR compliant? No. It tests what a browser can observe on the pages you give it. It does not check your privacy policy, purposes, vendors or consent records. Use it to find and monitor problems, not as a certificate.

Why does it report tracking after Reject when my CMP blocks everything? Usually tags hard-coded outside the CMP, tag-manager triggers that ignore consent, cookies set earlier and not deleted, or services listed as "necessary". The evidence names each cookie and request.

Is a Google Consent Mode "denied" ping a violation? It is reported as a warn. With Consent Mode "advanced", Google tags send cookieless pings before consent. EDPB Guidelines 2/2023 say these can still fall under Art. 5(3) ePrivacy; authorities have no single line yet. The most conservative option is Consent Mode "basic".

Why was no banner found? The site shows no banner to the tested location (use an EU proxy), the banner appeared late, or detection missed it. Set customBannerSelector and the button selectors; banner.diagnostics shows what the scanner saw.

Why did a page fail? Bot protection or a timeout. Failed pages are not charged. Retry with the residential proxy or a longer pageTimeoutSecs.

Limitations

• reject-as-prominent is a heuristic. Regulators judge prominence case by case, so it only warns.
• Consent Mode gcd decoding is based on community documentation, not an official Google spec.
• Purposes, IAB TCF strings, withdrawal of consent and the cookie policy are not checked.
• Cookie categories come from public databases; unknown cookies are marked Unknown, not as violations.
• Server-side tracking, fingerprinting without network traces and native apps are not covered.
• Banners that appear only after scrolling, after more than about 20 seconds, or after a login are not tested.
• Some report evidence strings (cookie details, request types) stay in English in the Dutch report.

Data sources and credits

• Open Cookie Database by the Open Cookie Database contributors (maintained by jkwakman), Apache License 2.0: https://github.com/jkwakman/Open-Cookie-Database
• EasyPrivacy by The EasyList authors (https://easylist.to/), dual-licensed GPLv3 / CC BY-SA 3.0. The Actor uses its domain entries to classify requests.

See data/ATTRIBUTION.md for details.

Licence texts: Apache License 2.0, GPLv3, CC BY-SA 3.0.

Keywords

cookie consent checker, GDPR cookie banner checker, consent verification, ePrivacy compliance, cookie audit, consent mode v2 checker, Cookiebot / OneTrust test, cookiebanner controle, AVG cookies, Autoriteit Persoonsgegevens cookiebanner.