Is your cookie banner actually stopping anything?
We open your live site the way a new visitor would and show whether Google Analytics, Meta Pixel, TikTok and other trackers send data before anyone clicks “Accept.”
Trackers firing before consent are generally unlawful — and easy to prove.
Under the ePrivacy rules every EU country has written into national law (PECR in the UK) and the GDPR, cookies and trackers that aren’t strictly necessary may only run after a visitor consents. On many sites that’s no longer true: the banner was set up once, ad tags were added later, and nobody has checked since whether the two still agree.
Regulators are fining exactly this.
Three decisions from the last thirteen months, all for the same root cause our scan checks for: cookies or trackers placed before valid consent.
Advertising cookies placed without valid consent when users created a Google Account, plus undisclosed ads in Gmail.
CNIL, Sept 2025 →Advertising cookies were placed the moment visitors landed on shein.com — before any consent choice was made.
CNIL, Sept 2025 →Same root cause, a fraction of the size: cookies fired before the banner had even been answered.
CNIL, Nov 2025 →The CNIL also runs a fast-track "simplified procedure" for smaller, straightforward cases — a missing banner, cookies set without consent. 23 companies were fined this way since January 2026 alone, averaging €5,815 each. Names aren’t published, but for the business paying it, the investigation and the fine are just as real.
CNIL, 2026 →Three steps, no code changes on your end.
Enter your domain
We open your site in a real browser session with no login — exactly how every new visitor first sees it.
We watch what fires first
Every network request and cookie set before your banner is answered gets logged and matched against known trackers.
Your proof of check — or your fix
If nothing is found, you get a dated, shareable proof of check. If there are issues, you get a plain-English report with concrete steps to fix them.
The services that keep showing up in fines and complaints.
Every scan ends in one of two documents.
No trackers found firing before consent. A dated proof for your footer or your next client pitch — it reflects the state at the time of the scan.
Which trackers fired, the exact request as evidence, and the Consent Mode v2 or cookie-banner setting that fixes it.
What we see on real websites
websites of small and mid-sized businesses in our sample
sent data to trackers before the visitor had consented
of those cases involve Google Analytics or Google Tag Manager
Start with one report. Stay for peace of mind.
Questions we hear most often
Does it work with my website or shop system?
Yes — with any public website; we only need the address and nothing is installed. We know the typical weak spots of the big systems: on Shopify, apps and pixels that load outside Shopify’s own cookie banner; on Shopware, tracking plugins and theme code that bypass the built-in cookie settings; on Wix, code added under “Custom code” without a cookie category; on WordPress, caching plugins that load scripts before the banner. The report names the exact script, so whoever looks after your site knows where to look.
I already use Cookiebot, Usercentrics or Borlabs. Why do I need this?
A consent tool shows the choice — it doesn’t guarantee that every tag respects it. Tags get added later, a theme update loads a script directly, or Consent Mode is set up incompletely. Bannerproof independently checks what your live site actually sends before and after the visitor’s choice.
Do I need to install anything or change code?
No. We open your site in a real browser, like a new visitor. Only if something needs fixing does the report tell you exactly where.
I run a practice, hotel or restaurant — what do you check there?
Mostly the embedded extras: Google Maps, YouTube videos, Google Fonts and reCAPTCHA on contact forms — they can send your visitors’ IP addresses to Google before consent. Booking and appointment widgets are flagged when they load known trackers before consent.
Where do the scans come from?
From European IP addresses (Germany, the Netherlands and the UK). Many consent tools behave differently for visitors outside the EU — scanning from Europe shows what your European visitors actually get.
How exactly does the check work?
We open your homepage and up to two subpages in a fresh browser, like a first-time visitor, and record every request and cookie before anyone clicks the banner. Then we click “Reject all” (if the banner has one) and check whether anything keeps sending data. Paid reports also click “Accept” and check that your tags then actually work. Every finding comes with the exact request as evidence.
How do you handle Google Consent Mode v2 (Advanced)?
In short: Google tags that correctly wait for consent are not flagged. In “Advanced” mode, Google sends signals without cookies before consent — we don’t count those as tracking. We only flag Google tags that are allowed to store or use data before the visitor has chosen, or where the consent setting is missing altogether.
Is this legal advice or a certification?
No. It’s an automated technical check of what your site sent at the time of the scan, with a dated proof of check if nothing was found. For a legal assessment, talk to a lawyer or your data protection officer.
I can’t fix it myself — what now?
Forward the report to your agency or developer with a private link — no login needed. Every issue comes with step-by-step instructions, and you can run the free scan again afterwards to check the fix.
Do I need a data processing agreement? What do you store?
For the scan itself, usually not: we visit your public website like any other visitor and don’t process your visitors’ or customers’ personal data on your behalf. We store the scan result — the address, the requests and cookies found and a screenshot of the homepage. With an account we also store your email address and plan details, as described in our privacy policy.
How do invoicing, VAT and cancellation work?
Payment runs through our payment provider Paddle, which acts as the official seller: you get a proper invoice with VAT shown, and prices include VAT where applicable. Subscriptions can be cancelled at any time, and your first payment is covered by a 14-day money-back guarantee.
