tag managers
Containers and IDs
GTM containers, loaded or only declared, custom dataLayer names and server-side hosts. Also Adobe Launch and Tealium.
// every request, every phase
Your banner said no. Did your tags listen?
Tracking Audit opens your site in a real browser, answers the cookie banner like a visitor would, and captures every script, beacon, pixel and cookie. Anything that fires without permission shows up in red.
No tag manager accessNothing to installFree start page audit
audit · example.nl · consent=reject
pre-consentGET googletagmanager.com/gtm.js id=GTM-XXXXXX
pre-consentPOST facebook.com/tr ev=PageView ← marketing before consent
pre-consentSET _fbp 90 days · third-party owner
consentCLICK “Reject all” · Cookiebot · shadow DOM
post-consentPOST region1.google-analytics.com/g/collect gcs=G100 · denied, cookieless ping
post-consentGET analytics.tiktok.com/api/v2/pixel ← still sending after reject
post-consentPUSH dataLayer event=gtm.load · consent phase tagged
14tools
2pre-consent leaks
1after reject
27cookies
// recognises 60+ vendors, including
- Google Tag Manager
- GA4
- Google Ads
- Floodlight
- Meta Pixel
- TikTok
- LinkedIn Insight
- Microsoft UET
- Clarity
- Snap
- X
- Criteo
- Hotjar
- Adobe
- Segment
- HubSpot
- Matomo
- Plausible
// pricing
Start free. Pay per audit when you need more.
Credits cover one audit each. A Pro credit also covers a Standard audit.
Free
A first look
€0
- Start page
- Accept, reject or ignore
- Default wait time
- HTML report
- 3 free audits a day
Standard popular
The site, not just a page
€10 / audit
- 1 or 2 clicks deep, up to 7 pages
- All three choices compared
- Shorter or longer wait
- HTML, JSON and API
Pro
The full picture
€15 / audit
- Custom depth, up to 41 pages
- Your banner's own categories
- Custom wait time
- Hide personal values in reports
- Everything in Standard
Monitor
Weekly, unattended
€20 / 4 weeks
- Weekly Pro audit
- Per website
- Automatic retries
- Reports kept on your account
Pay with iDEAL, card or SEPA Direct Debit · one website per account*
* Multiple websites in one account for the Monitor plan is in the works.
// how it works
Three phases, recorded separately
Every request, cookie and dataLayer push is tagged with the moment it happened, so you see exactly what changes when a visitor makes a choice.
pre-consent
Before the banner
We load the page on a fresh device, wait for the network to settle and scroll to trigger lazy tags. Marketing that fires now has no permission.
consent
The choice
We click Accept or Reject on Cookiebot, OneTrust, Didomi, Usercentrics, CookieYes and others, or pick your banner's own categories. We look through shadow DOM and iframes.
post-consent
After the choice
Do the right tags switch on, and only those? Consent Mode updates are decoded, and anything still sending after “Reject all” is flagged.
// all three, side by side
Ignore, reject, accept. Same pages, three visits.
One audit makes three clean visits and compares them tool by tool. Follow your links 1 or 2 clicks deep and every page is checked in all three states.
- See which tools still send data after “Reject all”, and on how many pages
- Spot tags that never switch on, even after Accept
- Open the full site report for each visit
After “Reject all”, 2 tools still sent data: TikTok (3/7 pages), Hotjar (7/7 pages).
| Tool | Ignored | Rejected | Accepted |
|---|---|---|---|
| TikTok Pixeladvertising | 2/7 | 3/7 | 7/7 |
| Hotjarsession replay | 7/7 | 7/7 | 7/7 |
| Meta Pixeladvertising | 1/7 | – | 7/7 |
| GA4analytics | – | – | 7/7 |
| Google Tag Managertag manager | 7/7 | 7/7 | 7/7 |
pages where the tool sent requests · example data
// what we check
Everything a browser can see
The browser is hooked before any page script runs, so nothing loads behind our back. That includes tags a tag manager pulls in.
google
Consent Mode decoded
Default and update state per type, gcs and gcd per GA4 hit, and batched events split one by one.
cookies
Set before consent?
Every cookie with owner, purpose, lifetime and flags, and whether it landed before anyone agreed.
datalayer
Every push, timestamped
Each push with its consent phase, for dataLayer, adobeDataLayer and custom names.
findings
Ranked by severity
Pre-consent marketing, tracking after reject, duplicate page views, silent tags, failed hits and cookies over 13 months.
privacy
Personal data in hits
Plain-text emails and phone numbers in requests are flagged, and so are hashed identifiers.
// the result
A report for people, data for tools
HTML report
Readable in the browser, ready to save as PDF or send to a client. Findings first, then every request.
Findings 2 high · 3 medium
Tools 14 found
Cookies 27 · 4 before consent
dataLayer 31 pushes
JSON data
The raw results for spreadsheets, scripts and comparisons over time.
{ "vendor": "Meta Pixel",
"preConsentRequests": 1,
"postConsentRequests": 4,
"ids": ["1234567890"] }
Standard and ProAPI
Create a key on your account and run audits from CI or your own tools, with the same rules and credits.
curl -H "Authorization: Bearer $KEY" \
"…/api/audit?url=https://example.nl
&consent=reject"
Standard and Pro// monitor
A release shouldn't quietly break consent
Save an audit and it runs again every week at a time you choose. Failed runs retry automatically, and every report stays on your account.
w1
w2
w3
w4
w5
w6
w7
w8
w5 · TikTok started firing before consent after a deploy
// pricing
Start free. Pay per audit when you need more.
Credits cover one audit each. A Pro credit also covers a Standard audit.
Free
A first look
€0
- Start page
- Accept, reject or ignore
- Default wait time
- HTML report
- 3 free audits a day
Standard popular
The site, not just a page
€10 / audit
- 1 or 2 clicks deep, up to 7 pages
- All three choices compared
- Shorter or longer wait
- HTML, JSON and API
Pro
The full picture
€15 / audit
- Custom depth, up to 41 pages
- Your banner's own categories
- Custom wait time
- Hide personal values in reports
- Everything in Standard
Monitor
Weekly, unattended
€20 / 4 weeks
- Weekly Pro audit
- Per website
- Automatic retries
- Reports kept on your account
Pay with iDEAL, card or SEPA Direct Debit · one website per account*
* Multiple websites in one account for the Monitor plan is in the works.
// faq
Questions
Do you need access to our tag manager or analytics?
No. We visit your site from the outside, like a visitor on a fresh device. You only enter an address.
Which cookie banners can you click?
Known selectors for Cookiebot, OneTrust, Didomi, Usercentrics, CookieYes and TCF/GPP platforms, then a text match in English, Dutch, German, French, Spanish and Italian. If no button matches, we fall back to the banner's own API.
What can't it see?
Server-side forwarding, such as server-side GTM to the Meta Conversions API, happens away from the browser. It shows up only as hits to your own first-party endpoints. Each run is a single page load per page: click paths, forms and checkout flows aren't scripted.
What if our site blocks bots?
We use a standard Chrome user agent, but sites with aggressive bot protection can still refuse the visit. That's reported as a finding instead of an empty result.
Will audit visits pollute our analytics?
You can add a test parameter, such as ?audit_test=1, to every visited address. Filter it out in GTM or GA4 and audit traffic stays out of your reports.
Is this legal advice?
No. Tracking Audit shows what your site actually does. Whether that's compliant for your situation is for you and your privacy advisor to decide, and now you'll have the facts.
// one address, a few minutes
Find out what your banner really does.
Run a free start page audit. No card, nothing to install.