SiteVerdict — Cookie Consent & Consent Mode v2 Auditor

Prove whether "Reject" really stops tracking, with evidence your client can read.

The Actor opens each website three times in real Chrome: no click, then Reject, then Accept. After each click it reads back the choice the cookie tool actually stored. You get:

• what fired before consent and after Reject, with timestamps;
• a Google Consent Mode v2 pass/fail checklist;
• a white-label PDF evidence report with screenshots, ready to send.

Indicators, not legal advice. These are automated technical risk indicators for UK GDPR / PECR and EU ePrivacy, from one browser at one time. A qualified adviser should review them before you rely on them.

Why this one

Most cookie checkers on the Store list cookies or detect a banner. Very few click Reject, and none we found checks that the click was recorded before blaming the site. That check is what keeps false positives out of a client report.

	SiteVerdict	Typical cookie / consent checker
Clicks Reject and tests what still fires	✅ (incl. "Reject" behind a settings layer)	❌ or accept only
Confirms the click was recorded (reads the CMP / TCF / Consent Mode state back)	✅ — findings carry confidence; unconfirmed ones are "check manually", never scored	❌
What sent data (network) vs a script that merely loaded	✅	❌ (cookie lists / script presence)
Google Consent Mode v2 decoded (gcs/gcd) + pass/fail checklist	✅	❌ or "signals present"
CMPs	OneTrust, Cookiebot, Didomi, Usercentrics, Quantcast/InMobi, CookieYes, iubenda, Termly, Osano, TrustArc, Complianz, Google CMP, Sourcepoint, Civic, Transcend (closed shadow DOM) + 10 more + custom banners	3–12
Client-ready PDF with screenshots + timestamped request log	✅ white-label	❌
Monitoring (diff vs last run) + Slack / webhook alerts	✅	❌
AI fix plan with your own key (exact CMP/GTM change + policy wording)	✅ optional	❌
Bot-protection pages	reported as blocked, not charged	often scored as "clean"

See Benchmark below and BENCHMARK.md for the method and full results.

Three ways customers use it

1. Agencies. Run 1–200 client sites and hand over a branded PDF per site. Each PDF has banner screenshots, what fired before and after the choice, the Consent Mode checklist and the exact fix for their consent tool. Re-run after the fix to prove it worked.
2. Marketing and analytics teams. Catch the expensive bugs:
   • "Accept doesn't switch Google tags to granted", so conversions are lost;
   • the Consent Mode default is set after the first hit;
   • a GA4 ID returns 404;
   • duplicate page_view;
   • legacy Universal Analytics is still installed.
3. DPOs, privacy consultants and lawyers. Schedule a weekly monitor across your portfolio. You get a Slack or webhook alert the day a new tracker starts firing before consent or after Reject. A dated, timestamped evidence pack is attached for the file.

Before / after: what you get

A typical "checker" output:

banner: yes   cmp: OneTrust   cookies: 46 (22 first-party, 24 third-party)   score: 7/10

SiteVerdict output for the same kind of site (a real benchmark result from a large UK retailer, anonymised and shortened):

{
  "url": "https://www.uk-retailer.example/",
  "score": 53, "grade": "D",
  "cmp": { "name": "OneTrust" },
  "scenarios": {
    "reject": { "interaction": { "buttonText": "Reject all cookies" }, "verification": "confirmed" }
  },
  "findings": [
    { "severity": "high", "confidence": "high", "title": "Tracking continues after the visitor clicks Reject",
      "evidence": ["[reject / after click] TikTok Pixel C… (EngagedSession): https://analytics.tiktok.com/api/v2/pixel"] },
    { "severity": "medium", "confidence": "high", "title": "Analytics tags send data before consent",
      "evidence": ["[no-consent] Google Analytics 4 G-XXXXXXX (page_view): https://region1.analytics.google.com/g/collect?v=2&tid=G-XXXXXXX&…&gcd=13l3l3l3l1l1&…"] }
  ],
  "consentMode": { "version": "v2", "checks": [ { "label": "Default consent set before the first Google hit", "status": "fail" } ] },
  "evidence": { "reportPdfUrl": "…/client-report-uk-retailer.pdf", "requestLogCsvUrl": "…/evidence-uk-retailer.csv" }
}

gcd=13l3l3l3l1l1 means the hit was sent before any consent default existed. The checklist turns that into a plain "fail", and the fix guide gives the exact change for that site's consent tool. The PDF puts it on one page for the client.

Benchmark (25 real UK/EU sites)

Run on 11 Oct 2026 against 25 public sites across news, retail, SaaS/fintech, government and travel. Each site was visited once per scenario, politely, after a robots.txt check. A further 12 sites run by consent-tool vendors were used for CMP coverage. Every finding was reviewed by hand against its evidence.

Result (25 sector sites, manual review of every finding)	SiteVerdict 1.0	SiteVerdict 2.0	Checkers that never click Reject (documented)
False positives (non-info findings)	8 of 57	0 confirmed of 56 (1 unverified; 3 shown as "check manually", not scored)	n/a
Bot-protection pages scored as "clean"	2	0 (reported blocked, not charged)	not handled
Consent banners missed	1 (closed shadow DOM)	0	—
Reject choice confirmed by the consent tool	—	12 confirmed, 7 likely, 1 unconfirmed, 2 consent-or-pay correctly not clicked	not available
Sites in the set with tracking after Reject that were caught	4	5 (2nd-layer Reject now reached; with click-relative timestamps + confidence)	0 possible (no Reject click)
Avg time per site (3 visits + 1 inner page, PDF included)	44 s	53 s on a heavily loaded test server	2–30 s (single load)

Competitor Actors were not run (no spend on other developers' Actors). They are compared on their documented inputs and outputs. Method, the site list, per-site results and caveats are in BENCHMARK.md.

Pricing (pay per event)

Event	When	Price
site-audited	A site was fully audited (no click / Reject / Accept)	$0.19
evidence-pack	Client PDF + HTML, after-click screenshots and request log saved (on by default)	$0.06
extra-page-audited	Each extra internal page (all scenarios)	$0.04
quick-scan	First-visit-only scan (no clicks)	$0.03
ai-fix-generated	AI fix plan produced with your own API key (off by default)	$0.04
alert-sent	Slack / webhook digest delivered	$0.01

Examples:

Job	Cost
1 site, full audit + PDF	$0.25
100 sites + PDFs	≈ $25
Weekly monitoring of 20 sites with Slack alerts, no PDFs	≈ $15/month
1,000-site quick prospecting scan	$30

Not charged:

• sites that fail to load;
• sites behind bot protection (blocked);
• AI or alert steps that do not deliver.

Set a maximum total charge per run and the Actor stops cleanly when it is reached.

Input

{
  "startUrls": [{ "url": "https://www.example.co.uk" }],
  "scanMode": "full",
  "evidencePack": true,
  "reportAgencyName": "Your Agency Ltd",
  "reportClientName": "Example Ltd",
  "maxInternalPages": 1,
  "monitoringMode": false,
  "aiFix": false
}

Monitoring: set monitoringMode: true and a monitorName (one per client), then schedule the Actor. Each item gets a change object, for example:

"change": { "changed": true, "headline": "NEW before consent: Meta Pixel · 1 new issue(s): Advertising tags send data before consent" }

Add slackWebhookUrl or webhookUrl (both stored as secrets) to get one digest per run. onlyChanged: true keeps the dataset to the sites that changed.

AI fix (optional): set aiFix: true, aiProvider (anthropic or openai) and aiApiKey (your key, stored as a secret, never logged). Only the audit summary is sent: findings, tag names and IDs, the Consent Mode state and the CMP name. No cookies and no request log are sent. The plan covers:

1. CMP changes
2. GTM / tag changes
3. A Consent Mode v2 snippet
4. Cookie-policy wording
5. How to verify

It is embedded in the PDF and saved as Markdown.

Output

• Dataset, one item per site. Views:
  • Overview
  • Client reports & evidence
  • Consent Mode v2 checks
  • Findings (with confidence)
  • Tracking IDs
  • Changes (monitoring)
• Key-value store, per site:
  • client-report-<site>.pdf and .html
  • evidence-<site>.csv and .json: the redacted request log with times relative to the click
  • screenshots before the choice, after Reject and after Accept
  • ai-fix-<site>.md (if AI fix is on)
• Key-value store, run level: REPORT (HTML for all sites) and SUMMARY (agent-ready JSON).

How findings are graded:

Field	Values
Severity	critical / high / medium / low / info
Confidence	high: the consent tool confirmed the choice; medium: the banner closed but the state could not be read; low: check manually, not scored

Scores: consent behaviour and tag health, each 0–100, plus the overall score and a grade.

How accuracy is protected

These are the false-positive guards, each covered by tests:

• Choice read-back after every click, from these sources:
  • CMP cookies and APIs: OneTrust (by group name), Cookiebot, CookieYes, Didomi, Usercentrics, Osano, TrustArc, iubenda, Complianz, Transcend;
  • IAB TCF strings and the Google CMP;
  • GOV.UK / NHS-style JSON cookies;
  • the Google Consent Mode state.
• Wrong-click guards. It never clicks "More options" as Reject or "Accept only essential" as Accept, and it ignores accordion headers in preference centres.
• Only data actually sent counts. These do not count:
  • script downloads;
  • cookieless Consent Mode or Microsoft UET (asc=D) pings;
  • Google npa=1 / limited-ads requests, which get their own low-severity note;
  • beacons already in flight when the button was clicked.
• Cookie names are matched on the vendor's own domain. A first-party uid is not Criteo.
• Late banners are waited for. Closed shadow DOM banners are handled. Consent-or-pay banners are recognised and the paid option is never clicked.
• Bot-protection pages are reported as blocked, not as a clean site.

FAQ

Does it log in, submit forms or get around bot protection? No. It loads public pages and clicks cookie-banner buttons, the way a visitor would. It never solves CAPTCHAs or bypasses protection. If a site shows a bot check, the site is marked blocked and is not charged.

Why does a finding say "check manually"? Either the consent tool did not confirm the Reject/Accept click, or a check depends on something a browser cannot see, such as server-side tagging. Those findings are shown but never scored.

Is analytics before consent always a breach? Not necessarily. The UK Data (Use and Access) Act 2025 created a narrow exemption for some statistics cookies, and some EU regulators (for example the CNIL) exempt strictly configured audience measurement. That is why analytics-only issues are rated medium and advertising or session-replay issues high. Ask your adviser.

Can I white-label the PDF? Yes. Set reportAgencyName and reportClientName.

Which country's banner do I get? Banners are often geo-targeted. Use Apify Proxy with your visitors' country (GB, DE, FR…), and set the browser language and time zone.

Limits

• One snapshot from one location and device profile (desktop Chrome). Banners and tags vary by country, A/B test and time.
• Tags that wait for scrolling or another interaction may not fire. Server-side tagging is only visible as far as the browser sees it.
• WebSocket traffic, used by some session-replay tools, is not captured. A replay script that loaded but showed no data is reported as low severity.
• It does not judge your banner wording, colours or legal basis.

Compliance and sources

• Personal data:
  • The Actor collects no personal data about individuals.
  • Request logs keep only tag parameters (tid, en, gcs, gcd, id, ev…). Client IDs, user IDs, page paths, referrers and titles are redacted.
  • Cookie values are never stored. Consent-cookie values are parsed in memory and only the derived yes/no is kept.
• Your API key and webhooks: the AI key and webhook URLs are secret inputs. They are never logged or output.
• Sources:
  • ICO, storage and access technologies guidance (2026): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/
  • Data (Use and Access) Act 2025: https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement
  • Google Consent Mode: https://developers.google.com/tag-platform/security/guides/consent
  • EDPB Cookie Banner Taskforce report (17 Jan 2023)
  • IAB TCF v2.2 technical specification
  • gcs/gcd meanings follow public reverse-engineering write-ups and are not official Google documentation.

Disclaimer: these are automated technical risk indicators, not legal advice, and not a certification of compliance with UK GDPR, PECR, EU GDPR or the ePrivacy Directive.

---

Made by SiteVerdict (BharatFare Travel and Technologies Ltd, UK). Pair it with the SiteVerdict Cookie & Privacy Policy Checker, which checks that your cookie and privacy policies match what the site really sets and drafts the missing wording. Contact: Use the Issues tab on this Actor's Store page.