Cookie Consent Violation Checker

Opens a site in a real browser, touches nothing, and records which third-party trackers fire anyway.

No clicks. No "Accept". No scrolling. No cookies carried over from a previous site. If a request to facebook.com/tr left the browser, it left without consent — and you get the request URL as evidence, not an inference read from the HTML.

Why this is evidence and not an opinion

Most "cookie scanners" grep the page source for a pixel snippet. That proves nothing: a tag manager may hold the tag until consent, or fire it server-side. This Actor watches the network layer of an actual Chromium instance. What it reports is the request that happened.

Legal context (not legal advice): Article 5(3) of the ePrivacy Directive (2002/58/EC) requires prior consent before storing or accessing information on a user's device, unless strictly necessary for the service requested. In Planet49 (C-673/17) the CJEU held that consent must be an active choice. Analytics and advertising are not strictly necessary. This Actor reports the technical fact; what to do about it is for you and your counsel.

Who this is for

• Agencies and consultants doing a privacy or compliance audit before a pitch, with a finding the prospect can reproduce in ten seconds.
• Anyone who installed a consent banner and wants to know whether it actually holds the tags back — a very common misconfiguration is a banner that displays while the tags load behind it.
• Privacy and legal teams building a defensible record of what a site did, with timestamps and URLs.

What it refuses to report

• First-party requests. A request to the site's own domain proves nothing — it may be the page itself, a font, or the consent platform loading.
• The consent platform itself. OneTrust, Cookiebot, Usercentrics, Didomi, Iubenda and the rest must load before the choice is made; that is their job. Counting them would accuse a site of doing exactly what it is supposed to do. They are reported separately in consent_platform.
• Universal illegality. Prior-consent rules are EU/EEA and UK rules. The jurisdiction_note field says so in plain words instead of letting a list imply a violation everywhere.

Input

Field	Type	Description
urls	string list	Sites to check, one per line.
onlyTargets	boolean	Return only sites where a tracker fired before consent.

{
    "urls": ["bbc.co.uk", "example.com"],
    "onlyTargets": false
}

Output

Field	Meaning
finding	e.g. "3 third-party tracker(s) loaded before any consent was given: Google Analytics, Meta (Facebook) Pixel, TikTok Pixel".
trackers_before_consent	How many distinct trackers fired.
evidence	The actual request URL observed for each tracker.
consent_platform	Which consent platform was detected, or none detected.
jurisdiction_note	Whether the domain suggests a jurisdiction where prior consent is required.
how_to_verify	How to reproduce the finding yourself, in a private window.
legal_basis	The directive and case law the context rests on.

Pricing

Pay per site with findings. Clean sites, sites that fail to load, and sites outside the relevant jurisdiction are all returned in the dataset free of charge.

Notes

Each site gets a fresh browser context with no stored cookies. Without that, a consent cookie set on site A can suppress the banner on site B and quietly corrupt every result after the first.