Method
How the test is done.
A real Chrome browser loads your site’s home page like a visitor, without clicking anything, then replays three journeys and compares what happens.
The three states
- Before any choice. Page loaded, 6 to 15 seconds of waiting (some banners appear late), no click. We record the cookies, the local storage, the addresses contacted and the banner’s buttons.
- After “Refuse”. Click on the refuse button of the first layer; otherwise open the settings to look for the refusal. Then record, reload the page, visit two pages of the site, record again.
- After “Accept”. New session, click on “Accept”, record.
The nine checks
| Check | What is compared |
|---|---|
| Consent banner | Is a banner recognized? If not, are any trackers active? |
| Before any choice | Tracking cookies and calls to tracking services with no click at all. |
| Refusing as easy as accepting | Refusal on the first layer, behind “Settings”, conditional (“refuse and subscribe”, “pay or accept”) or absent. |
| Same visual weight | Size and style of the Refuse and Accept buttons. |
| Refusal blocks tracking | After refusal, reload and navigation: new tracking cookies and calls to ad networks. |
| The choice is remembered | The banner does not come back after a reload. |
| After “Accept” | The tools load; otherwise they are not connected to the banner, or were already active before. |
| Google Consent Mode v2 | Default “denied” values, update on choice, Google calls announcing denied or granted consent. |
| Cookie lifetime | Tracking cookies lasting more than 13 months. |
The three verdicts
- OK Nothing abnormal on this point, within what was tested.
- To check A sign worth examining that is not enough to conclude: the tool explains why and what to look at.
- To fix A clear deviation from what is expected.
A “not applicable” item means the check does not apply (for example Consent Mode on a site with no Google tag).
How cookies are classified
Each cookie is classified as: exempt (technical, security, load balancing, or simply remembering the user’s choice), functional, audience measurement, advertising or profiling, or to examine when its name looks like an identifier without being known. The classification relies on the Open Cookie Database (Apache 2.0 license, reduced to a few columns), on rules written for OpenCookies and on a list of tracking services maintained by OpenCookies.
Some cases are always rated “to check” rather than “to fix” because no conclusion can be drawn from the browser: audience measurement that may be exempt from consent depending on its configuration (for example Piano Analytics, AT Internet), and Google “Consent Mode” calls without cookies (gcs=G100), which record nothing but still send the IP address to Google.
What the test does not cover
- A single pass, from the region shown in the report, with an automated browser: some sites adapt or hide their banner in that case. A banner that was not seen makes the verdicts “to check”.
- The home page and at most two other pages; no account login, no purchase journey.
- The lists of tracking services and cookies are partial: a service missing from the lists is not detected.
- Withdrawal of consent (reopening the preferences to withdraw one’s choice) is not tested yet.
- It is not legal advice. The tool never says “compliant”: it says what it observed and what it did not test.
Respect for the sites tested
The test respects the site’s robots.txt file and bypasses no bot protection. It never records the value of a cookie, only its name, domain and lifetime. It only visits a few pages. It refuses addresses that point to a private network.