CMPAUDIT doesn't take your setup's word for it. It loads your site the way a regulator's browser would — before consent, on accept, on reject, and with Global Privacy Control on — and watches the wire: every tracker, cookie, and consent signal that actually fires. Evidence of what happened, not a screenshot of what was configured.
Sign in with Google. No tag to install — we scan from the outside, like a regulator would.
Consent leaks aren't only a regulator's concern. Plaintiff's lawyers — the firms behind today's wave of privacy demand letters and wiretap-style claims — are actively scanning sites for pre-consent tracking, pixels that fire after opt-out, and ignored privacy signals.
They rely on the same browser-level evidence CMPAUDIT captures. Run the audit first, fix what leaks, and take the easy target off your back — remediation is almost always cheaper than the settlement.
We audited a nationally recognized US organization — a site featured as a success story by one of the leading consent platforms. Its CMP was deployed, its Accept and Reject buttons worked, its California rules were in place. And yet, after Reject:
All documented from a single page, in one automated run, from a California IP.
// Observations, not legal conclusions. Site kept anonymous.
Everything that fires before the visitor chooses anything.
The tags that should run, do run.
The trackers firing a moment ago go quiet — or they don't.
Global Privacy Control (GPC) is a CCPA obligation. Does the site honor it?
We don't sell a CMP, so we've no stake in what the audit finds.
We scan from the outside — nothing to install on your site.
We click accept and reject and measure the outcome — not passive scanning.
Language documents behavior; you draw the legal line.
// scheduled audits · variance digests
137 fingerprints name GA4, Meta, LinkedIn, TikTok and 130+ more automatically. Anything else that behaves like a beacon or tracker is flagged too — even if it's not in the database yet.
OneTrust, Termly, Cookiebot, Usercentrics, TrustArc, CookieYes, Didomi, iubenda — plus homegrown banners.
Run an audit from any of seven jurisdictions — California, Illinois, France, Germany, UK, Brazil, Canada.
Honors Global Privacy Control, and reads the consent signals in the tracking requests themselves — so you see exactly what each vendor was told.
In advanced mode, Google's tags send cookieless pings before a choice is made; in basic mode, nothing fires until consent. We detect which one you're running and check it behaves the way that mode should.
GDPR expects opt-in — nothing until "yes." CCPA allows opt-out — tracking runs until "no." We test against the model your jurisdiction actually uses, so pre-consent activity is judged correctly, not flagged blindly.
When a report is locked, CMPAUDIT computes a SHA-256 hash of it. Anyone can re-hash the document and confirm it's byte-for-byte identical to what was captured — tamper-evident proof the evidence hasn't changed since the day it was recorded.
Each report covers the pages audited at the time of the run — a point-in-time record, not a continuous or site-wide guarantee.
No account needed and nothing to install. We run the audit of your site and email you the results.
We'll run the audit on and email the results to .
If anything about the site keeps the audit from running — no reachable Reject choice, a bot wall — we'll reply to that address instead of leaving you guessing.