Free scan
What is your website loading before anyone says yes?
Most sites load more than their owners expect, and the surprises are rarely the tools anyone chose deliberately. Enter your domain and find out.
Everything the page loads
Cookies, storage, third-party requests, pixels, beacons and embedded services, with the page each one came from.
The three states
What runs before a choice, what still runs after a refusal, and what runs once accepted — the comparison that shows whether consent is doing anything.
The unknowns
Third parties that match no known signature, which is usually where the uncomfortable findings are.
Signal diagnostics
Whether a consent signal was detected, and whether it arrived before the tags that depend on it.
What a result looks like
A row per service, a column per state.
The middle column is the one that matters: what still runs after somebody refuses. Almost nobody checks it, which is why it is almost always where the problem is.
| Service | Before choice | Rejected | Accepted |
|---|---|---|---|
| Site sessionNecessary | Fires | Fires | Fires |
| Google AnalyticsAnalytics | Held | Held | Fires |
| Meta PixelMarketing | Held | Held | Fires |
| YouTube embedMarketing | Held | Held | Fires |
| Unknown scriptNeeds review | Fires | Fires | Fires |
The last two rows are the interesting ones: an embed that is gated rather than blocked, and a script nobody has classified — which fires in every state precisely because no rule covers it.
What this scan is, and what it is not
- It is a privacy implementation scan. It reports what your website loads, stores and sends, and how that changes across the three consent states.
- It is not a legal compliance test. No scan can tell you whether your business meets its legal obligations. It tells you what your site does; what that means for you is a question for your own advisers.
- It is not a security scan. We are not looking for vulnerabilities and will not report any.
- Public pages only. Scanning authenticated areas needs proof you control the site, so it is configured deliberately rather than available to anyone who types a URL.
- During early access, scans are queued. They are run by hand and the report comes back by email. We would rather say that than show a progress bar with nothing behind it.
The list is usually longer than the team expects.
That is the useful part. Knowing what is there is the step everything else depends on.
No code to install for a scan Public pages only DotCensus runs on DotCensus