Help and FAQ
Everything on this page is about one question: which cookies and third-party trackers fire on your site before a visitor consents, and what to do about the ones that should not. If your answer is not here, email Fuuqiu at Fuuqiu@gmail.com.
Last updated 2026-09-07
How a scan works
A scan is a sequence, and the order matters more than any single step in it:
- A clean browser context. No cookies, no storage, no consent from a previous run. Anything you see in the pre-consent capture was set by your site on a first visit.
- The pre-consent capture happens first — before we even identify your consent platform. Detecting a platform means running script in the page, and a scanner that touches the page before recording what the page did has contaminated its own evidence.
- The banner is clicked. We look for the vendor's own accept control, then for accept-style wording, then for the largest button inside the overlay.
- The page is reloaded and captured again. We reload rather than watch in place, because a tag that was correctly blocked before consent usually only fires on the next page load — watching in place would under-count the after side and make a working banner look like it did nothing.
- The two captures are diffed into cookies and hosts seen only before consent, only after consent, or in both, and each is classified against an open cookie database and a host-to-vendor map.
The whole run is usually finished in under a minute. If it takes longer than the budget allows, the scan returns an error rather than a half-captured result.
Reading a result
| Verdict | What it means | What to do |
|---|---|---|
| Pass | Nothing classified as non-essential fired before consent | Re-scan on a schedule — the usual cause of a regression is a change nobody told you about |
| Fail | At least one non-essential cookie or third-party host fired before consent | Work down the finding list; each row names the cookie or host and the vendor we mapped it to |
| No banner | No consent mechanism was found on the page at all | Check the banner is served in the region we scanned from, then re-scan |
| Error | The scan could not complete | Usually bot protection, a redirect loop, or a page that never finished loading. Try the canonical URL rather than a redirect |
An Unclassified cookie or vendor is not an accusation — it means our database does not recognise it. Judge it yourself from the screenshot and the request list, and tell us about it so the classification improves.
Fixing pre-consent tracking, by consent platform
The pattern is the same everywhere: the platform blocks only what it has been told to block. These are the usual first places to look. Vendors change their consoles, so treat each line as where to start rather than as current documentation.
- Cookiebot — automatic blocking only applies when the Cookiebot script loads before every other script in the document head. Scripts it does not recognise need marking by hand with
type="text/plain"anddata-cookieconsent="statistics"or"marketing". - CookieYes — turn on auto-blocking in the site settings, then check Script Manager: anything added by a page builder, a theme option or a tag manager usually has to be listed there before it is held back.
- OneTrust — every cookie has to be assigned to a category in the categorisation report and the script republished. Untagged scripts need
type="text/plain"and the category class, such asclass="optanon-category-C0002". - Osano — check that the consent-first behaviour is enabled rather than the notice-only mode. Anything loaded through a tag manager needs the tag manager itself gated, because Osano cannot see inside a container it did not load.
- Complianz (WordPress) — the plugin gates the services it knows. A script pasted into a widget, a header hook or a custom HTML block is invisible to it until you add it in the script centre with the right category.
- Google Tag Manager, whatever the platform — if the container itself loads before consent, every tag inside it can too. Either gate the container or drive it entirely through Consent Mode.
After each change, re-scan. The point of an independent test is that it is the browser's opinion rather than the console's.
Google Consent Mode v2
Every scan reads the four Consent Mode v2 signals out of the page's dataLayer as they stand before you touch the banner: ad_storage, analytics_storage, ad_user_data and ad_personalization.
We report each one as granted, denied or missing, and the difference between denied and missing is the whole point. denied means a default was set and it is the safe one. missing means no default was set at all, so Google's tags fall back to their own behaviour rather than to yours — which is the failure mode that looks fine in the console and is invisible without a browser-level test.
The fix is almost always a default consent command that runs before any Google tag loads, setting all four to denied, followed by an update when the visitor accepts.
Monitoring, schedules and alerts
- Free monitors 3 sites with manual re-scans and 7 days of history. Alerts are recorded against your sites but not delivered — the record stays visible in the app.
- Pro monitors 25 sites on a weekly schedule with 90 days of history, and delivers alerts by email and Slack.
- Agency monitors 50 sites daily with 365 days of history, white-label PDFs, client share links and 5 seats.
- Alerts fire on a change, never on a schedule. A week in which nothing changed produces no email, because a monitoring tool that emails you every week is a monitoring tool you filter into a folder.
- Slack is connected by pasting an incoming-webhook URL. We send a test message before storing it and only mark it verified if that message arrived; after that the URL is only ever shown back to you masked.
Billing
- Change plan, change card, download invoices, add seats or cancel: Account, then Manage billing, which opens the Stripe customer portal.
- Cancelling stops the next renewal and keeps your plan working until the end of the period you paid for.
- Prices exclude tax; Stripe adds VAT or sales tax at checkout based on your billing country and any tax id you enter.
- The first payment on a new subscription is refundable in full within 14 days — see the refund policy.
What this tool does not do
ConsentProof does not serve a cookie banner, does not write your cookie policy, and cannot make a site compliant. It tests one thing — whether non-essential cookies and third-party trackers fire before a visitor consents — and records what it saw, with a timestamp. Keep whichever consent platform you already use; an independent test is worth more than one run by the vendor being tested. Results are evidence, not legal advice.
Common questions
- What does a scan actually do?
- It opens your page in a real Chrome browser with an empty profile — no cookies, no local storage, no prior consent — and records every cookie set and every third-party host contacted before anything is clicked. It then identifies the consent platform, clicks accept-all, reloads the page, and records the same two lists again. You get both states, a screenshot of each, an absolute UTC timestamp and a SHA-256 hash of the evidence. A scan is usually finished in under a minute.
- Why does my site fail when my consent banner is installed?
- Almost always because the banner is displayed before consent but the tags are not blocked before consent. A consent platform only blocks what it has been told to block: scripts it recognises, or scripts you have explicitly tagged. Anything pasted straight into the theme, injected by a page builder, or fired from an untagged Google Tag Manager container will load regardless of what the banner says. The finding list on your result page names the exact cookie or host that fired, which is the thing to go and gate.
- Are the results free, and do I need an account?
- Public scans are free, need no account, no email and no card, and return the full evidence rather than a summary. They are limited to 3 scans per IP per day · 1 scan per site per hour. An account is what turns a one-off check into monitoring: 3 sites, manual re-scans and 7 days of history are free too.
- What do the verdicts mean?
- Pass means nothing we classify as non-essential fired before consent. Fail means at least one non-essential cookie or third-party tracker fired before consent, and the finding list says which. No banner means we found no consent mechanism at all on the page. Error means the scan could not complete — usually a site that blocks headless browsers, a redirect loop, or a page that never finished loading.
- Can I share a result with a client?
- Yes. Every result page has a permanent public link that works without an account, on every plan including Free, so you can paste it into an email straight away. It is marked noindex, so it never appears in a search engine. Agency adds an expiring, optionally password-protected client link and a white-label PDF.
- How do I delete my data?
- Deleting a site deletes its scans and screenshots. For the whole account, email Fuuqiu@gmail.com from the account address and we delete the account, its workspaces, sites, scans and stored evidence within 30 days. For an anonymous public result, send us the link and we will remove it.