ForensicConsent — Cookie, GDPR & Pre-Consent Tracker Audit

Cookie, GDPR & tracker audit: see which pixels, analytics, chat and session-replay scripts send data before your visitors consent.

ForensicConsent audits any web page for the third-party tracking that drives privacy claims: marketing pixels, analytics, live-chat widgets and session-replay scripts that transmit a visitor's data BEFORE that visitor has consented. Open it on any page and you get a grade, a list of exactly which trackers fired before consent, what category each one is, and the legal theories those pre-consent transmissions are commonly cited under — US CIPA "wiretapping" claims and EU GDPR/ePrivacy. THE GRADE Three outcomes, based on how many third-party requests fired before consent: • A — Clean (none) • C — At risk (one or two) • F — High exposure (three or more) WHY THIS MATTERS US wiretapping demand letters and EU cookie-consent enforcement turn on the same fact pattern: data leaving the browser to a third party before the user agreed. Some reference points, each from a primary source — CIPA provides $5,000 in statutory damages per violation (Cal. Penal Code § 637.2); France's CNIL fined Shein €150 million in September 2025 for cookies set without consent. California's SB 690 (signed September 30, 2026) ended private "pen-register" claims over ordinary pixels and cookies, but left the §631 interception claim — session replay, chat widgets, and pixels that forward what a visitor typed — untouched. ForensicConsent's exposure flags reflect that: they lead with contents capture and never present a pen-register theory as a private claim. FREE • Per-page pre-consent tracker scan with the A / C / F exposure grade • 82 known vendors identified by name and category, in the order they fired, with the identifier parameters each one sent • Catches vendors served from your own domain (first-party CNAME / path signatures), the trick the most-sued replay and fingerprint tools use to evade blockers • Consent-gate detection — including banners that are present but do NOT actually block tracking, and CMPs that auto-consent without ever showing a banner • Legal-exposure flags (US and EU) on each pre-consent request • A VPPA flag when a video player shares a page with a pre-consent tracking pixel • A remediation recipe for what you found • A labelled screenshot you can hand to a client PAID — $29/month, or a one-time $37 for a 30-day pass; 5 seats $124/month, 15 seats $225/month • Whole-site crawl (same-origin, up to 25 pages) instead of one page at a time • Scheduled re-scans — daily, weekly or monthly — building a dated timeline • Tamper-evident records: each audit is canonicalised, SHA-256 hashed and chained to the previous record, then anchored with an independent RFC-3161 trusted timestamp and an ed25519 server signature. That means a record cannot be quietly backdated or altered, and it can be checked offline. • Before/after remediation proof — the same page, graded again, on the record • The "gotcha" sentinel test — types a unique token into a chat or form field and watches whether it leaves in a request. It cannot see inside cross-origin iframe chat widgets. • Deposition-packet export and an AI fix-prompt PERMISSIONS, AND WHAT IT DOES NOT ASK FOR Detection works by observing network requests read-only — ForensicConsent does not block, modify or redirect anything, and it does not request the cookies, history, debugger or management permissions. It reads all sites because the site being audited is whichever one you open it on, and trackers fire before any click, so it has to be watching from page load. PRIVACY Detection runs entirely in your browser. The request list, the record, page content and screenshots stay on your device. Data leaves only here: your licence token and a random device ID when you activate a paid plan; the audit's hash, the page URL and the capture time when a record is anchored for a timestamp — never the page's content, only its hash; and a random device ID when the extension checks for in-app messages, which happens on the free tier too. ForensicConsent runs no analytics on you and does not sell data. Full policy: https://forensicconsent.com/privacy.html ForensicConsent is an auditing and evidence tool. The exposure flags are informational: they name the legal theories such transmissions are commonly cited under. Whether any violation actually occurred is fact- and jurisdiction-specific. It is not legal advice, it is not a guarantee of legal compliance, and it does not warrant that every tracker will be detected.