Module 01
Banner & Behaviour
32
Default state correct, reject-all a single click, language fallbacks present, accessibility checks, region routing.
DefaultReject UXi18nA11y
CONSENT & CMP VALIDATION
Verify your CMP actually does what it says.
92 checks across 3 modules — Consent Mode V2, IAB TCF, and the cookies actually set after the user clicks decline.
consentaudits.com · live audit
▲ad_storage granted before banner shown4s ago
✗GA4 cookies present at denied state11s ago
▲TCF string missing for vendor 75518s ago
✗Reject-all still loads Meta pixel25s ago
92
validation checks
3
audit modules
12+
regions tested
how it works
Three layers of evidence.
Configuration alone lies — what's there isn't always what fires. We pair the source of truth with live execution data and version history, so every finding has receipts.
L1 · BANNER
See the real banner.
Render your CMP across regions, languages and devices. Verify default state, granular controls, language fallbacks, and whether reject-all is a one-click action.
L2 · SIGNALS
Trace Consent Mode V2.
Capture every gtag consent default and update call. Verify ad_user_data, ad_personalization and ad_storage flow correctly into Google's signal pipeline.
L3 · COOKIES
Audit what actually got set.
Walk every consent state — granted, denied, partial — and inventory cookies and storage actually written. Compare against your CMP's vendor disclosures.
audit coverage
3 modules. 92 checks.
Every check ties back to a specific failure mode our team has seen in production. No filler. No “best practice” tax. Run the suite or pick a module — both are first-class.
Module 02
Consent Signals
36
Consent Mode V2 default + update, IAB TCF v2.2 string validity, vendor list freshness, Google ads signals.
CMv2TCFVendorsAds signals
Module 03
Cookies & Storage
24
Cookie inventory at each state, third-party storage usage, fingerprinting checks, retention periods declared.
Inventory3p storageFingerprintRetention
sample findings
A taste of what typically surfaces.
Pulled from real reports (anonymised). Every finding includes evidence — a screenshot, a request trace, a JSON snippet — and a clear explanation of why it matters.
most-flagged · last 30 daysacross 2149 audits
01ad_storage granted before banner shown
02GA4 cookies present at denied state
03TCF string missing for vendor 755
04Reject-all still loads Meta pixel
05Banner localised only in English (DE, FR users)
06Default state set to 'granted' (non-compliant in EU)
the rest of the suite
One engine. Many audits.
Every tool reads its own surface but shares the same crawler, evidence store and report format. Run them independently or stitch them into a single integrity report.