Cookie & consent compliance
Most scanners check what happens when visitors accept.
Regulators check what happens when they refuse.
DataPal Privacy Pulse loads your site three times: untouched, after accepting, and after refusing. Each runs in its own clean browser session, so you see exactly what every choice does. Most sites pass the first two and fail the third without ever knowing.
One scan, three sessions
- 01UntouchedBanner not clicked
- 02After acceptingFull tracking footprint
- 03After refusingDid anything stop?
Cookies and network requests are recorded in each session, then compared. The third is where enforcement action concentrates.
Scan a site for Free - no account needed
We load the site, refuse the cookie banner, and report what still ran.
How the scan works
Every consent state is measured in its own clean browser session, never inferred, on desktop and on a phone. The first is the one that matters most.
- 01
Before any choice
We load your homepage and touch nothing. Anything that fires here is running without a lawful basis. This is the most common failure and the easiest to prove.
- 02
After accepting
We press accept and record what loads. This is your full tracking footprint, and the basis for a complete cookie notice.
- 03
After refusing
We press reject, following it into the preferences panel if that is where it is hidden, and check whether anything actually stopped.
Your site scan will show a compliance grade and privacy score
Scores start at 100, less a deduction per finding. A single critical finding caps the grade regardless of the arithmetic.
- A+100
- Nothing to fix. No tracking before consent, refusal honoured, no undisclosed transfers. Requires a perfect run.
- A90–99
- Defensible. Minor hygiene issues only. Defensible in an audit without qualification.
- B78–89
- Tidy up. No pre-consent tracking. Disclosure or cookie-lifetime issues an assessor would raise.
- C65–77
- Status quo. Typical of an average site. Marketing pixels are held back, but structural leaks from fonts, CDNs and unattributed vendors still expose visitor IPs. Carries Schrems II and data-sovereignty risk.
- D50–64
- Exposed. Consent is collected but not honoured, or tracking fires before it is given. Exposed to a complaint.
- E35–49
- Serious. Multiple concurrent consent failures. Remediation is a project, not a configuration change.
- F0–34
- Critical. Direct GDPR and PECR violation. Marketing pixels or Consent Mode pings fire before consent exists.
An incomplete scan is returned as Unrated, never as a low grade. Measuring nothing is not the same as finding nothing.
What you get
An overall site score and grade
Your site will be assigned a value out of 100 and assigned a grade from F through to A.
A report you can share
A graded PDF with every finding, the regulation it engages, and what your developers need to change. Not a wall of network requests.
Findings written for two audiences
Each finding says what happened in plain English, then provides technical insights to assist your team in reconfiguring settings.
A complete cookie inventory
Every cookie, its vendor, its purpose and its lifetime: the raw material that the cookie notice Article 13 requires you to publish.
Dark-pattern detection
We scan the site to assess what the user is offered. If refusing takes longer than accepting you have a finding regulators have fined for.
Evidence you can stand behind
Every report carries a fingerprint of the underlying capture, so the findings can be shown to correspond to a specific, unaltered scan.
Bulk-scanning for portfolios
Agencies and multi-brand groups run across hundreds of domains at once and get one comparable grade per site.
Site monitoring
Sites change and so will their privacy score and grade. You can monitor your site over time.
For brands & organisations
Know where you stand before someone else tells you
Marketing adds tags. Agencies add tags. Nobody removes them. Scan your own site and find out what is actually running before a complaint, an audit, or a customer asks the question for you.
For agencies & consultancies
Turn a compliance conversation into a work order
Scan a prospect’s site in under a minute and open the meeting with a graded, evidenced report. Bulk-scan your whole client book to see which accounts need attention first.
What this is not
This is a technical observation of what your website does in a visitor’s browser, at a point in time. It is not legal advice, and it does not assess your privacy notice, your records of processing, or anything that happens on your servers. When a site’s bot protection blocks us, we say so and mark the scan unrated. We will never tell you that you passed a test we could not run.
See what your site does right now
Five scans a month, free. No card, no sales call.
Scan your site for Free