Find cookies & trackers your site sets (no click / Reject / Accept) and check them against your cookie & privacy policies: missing cookies, UK GDPR Art 13/14 gaps, ICO/PECR consent issues. Generates a DRAFT cookie table & cookie policy. Not legal advice.
Shared SiteVerdict consent engine v2.0 (same as the Consent Auditor):
Reject/Accept read-back from the CMP and confidence on every finding ("check manually" items are not scored);
wrong-click guards and late-banner wait;
closed shadow DOM banners;
consent-or-pay detection;
bot-protection pages reported as blocked (not charged);
Google CMP and Transcend support.
Fix: "after Reject" double counting. It now counts only cookies/storage that are new after the click. Previously, a cookie set before consent and still present after Reject was also reported as "after Reject" (critical).
Fix: what counts as a tracker firing. These no longer count: library downloads (incl. session-replay scripts), cookieless Consent Mode / UET pings, Google limited-ads requests, and embedded video players.
Fix: generic cookie names.sb, SM, UID, MUID, bcookie… are only matched on the vendor's domain. Google AEC / SOCS are strictly necessary. YouTube YSC is functional.
New: client report (clientReport). White-label HTML + PDF per site with a first-visit screenshot. Event client-report.
New: monitoring mode. Detects:
policy text changes (hash only, the text is not stored);
policy URL and "last updated" changes;
new cookies not in the policy;
new cookies before consent;
new/resolved issues.
New: alerts to Slack / HTTPS webhook (event alert-sent).
New: AI-drafted policy wording with the user's own Anthropic / OpenAI key (event ai-fix-generated). Uses placeholders for anything not observed; DRAFT, not legal advice.
1.0 (11 Oct 2026)
First release.
Cookie and storage inventory across three consent scenarios: no click, Reject, Accept.
Covers cookies, localStorage, sessionStorage and third-party tags.
Each item gets a purpose category, provider, party, expiry and its consent state.
Policy discovery. Finds policy links in the footer, header and cookie banner, links from the privacy notice, and common paths (robots.txt respected).
Layered/hub notices are expanded with up to 8 sub-pages.
Short cookie pages are expanded with their "detailed cookie information" page.
Policy checks:
UK GDPR Art 13/14 privacy-notice elements, with evidence quotes and section headings.
Cookie-policy elements.
Inventory ↔ policy matching, at three levels: name, name pattern, provider.
Providers that are observed but not named, and providers that are named but not observed.
ICO/PECR consent indicators:
non-essential cookies before consent
tracking after Reject
no first-layer Reject
consent-or-pay
functional or unrecognised cookies set before consent
EU ePrivacy notes.
DRAFT outputs. A cookie-policy template (Markdown + HTML), a cookie table (Markdown) and the inventory (CSV), all clearly marked "DRAFT – not legal advice".
Pay-per-event pricing:site-checked and draft-generated. The run stops at the user's maximum total charge, and failed or empty work is never charged.
Detection logic for vendors, CMPs and cookies is copied from the SiteVerdict Tracking & Consent Auditor, with added functional vendors (Intercom, Zendesk, tawk.to, Stripe, reCAPTCHA, Contentsquare, SpeedCurve, Klaviyo).
