Three layers, one real browser.
What runs before consent, what the banner really does and where the data goes.
Before consent
Every request, cookie and storage write while the page loads — nothing is clicked.
- Tracker requests
- Cookies
- localStorage & IndexedDB
- CNAME-cloaked trackers
- Server-side tagging hints
Consent banner
Whether a banner is there and, in a site-wide crawl, whether “Reject” really stops the trackers.
- Banner present
- “Reject” test
- “Accept” test
- Google Consent Mode
Data flows
Where each third party sends data — by vendor jurisdiction and measured server location.
- Cross-border transfers
- Third parties
- Server location
Every scan covers the first layer and detects the banner. The “Reject” and “Accept” tests run in the site-wide crawl (Monitor and Compliance), when a banner is found. EU Court of Justice, Planet49 (1 Oct 2019): consent for non-essential cookies must be active and given before they are set.
Mapped to the standards.
Each finding names the article it touches, so legal and IT read the same report.
PrivaScan is automated: it reports what a browser can observe on the pages it tested. Whether a legal basis exists is for you and your DPO to judge — the report is evidence, not legal advice.
Know where your data goes.
Scan your website free and see what fires before consent.