Skip to content
CookieTrail
Run free audit
Menu
Repeatable international consent testing

Test consent
across borders.

Test your page from the countries your visitors use. Fresh browsers check first load, accept and reject in supported locations, then save the evidence for your developer or coding agent to investigate and verify a fix.

Run your first audit free See a sample report →

nothing to install · no client access · unsupported consent records stay inconclusive

see it happen↓
1 2 3

A visitor in Frankfurt.

You inspect the evidence.

Your engineer is handed the fix.

🌐 +36 regions
🇺🇸 california
🇺🇸 virginia
🇬🇧 london
https://alpinesupply.co 🇩🇪 Frankfurt
Diese Website verwendet Cookies.
0 cookies set
0 trackers active
0 leaking
⚠ Google Tag Manager waiting
! Meta Pixel 🔧 fix it waiting
! Google Ads 🔧 fix it waiting
♪ ⊘ TikTok Pixel waiting
f! Meta Pixel 🔧 fix it
! Leaking · fired after reject f⊘ Meta Pixel
⊘ Blocked · refusal respected

run № 2 · leak closed ✓

your engineer · or their coding agent
▸ paste fix-brief · alpinesupply.co · reject-all ▸ agent gating Meta Pixel + Google Ads behind marketing consent… ✓ done  shipped — verify with run № 2
COOKIETRAIL · FIX BRIEF
alpinesupply.co · UK · reject-all · run № 1
STOP META PIXEL FIRING AFTER “REJECT ALL”
observed  _fbp, fr present after rejection record    all-rejected (0/4 on) task      gate pixel behind marketing category verify    fresh profile → reject → _fbp absent
Leak closed ✓
open the full sample →
scroll
The whole picture

Visitor locations. A saved evidence report.
Actionable receipts.

Global coverage

Residential browser connections with local language and clock. Each customer capture checks that its browser country matches your selection.

A saved evidence report

Inspect screenshots, cookie snapshots and selected request endpoints with timing for each path. Download the report for your client or team.

Actionable receipts

Copy a finding's evidence and proposed fix to your developer or coding agent. A fresh check compares the result; missing coverage stays inconclusive.

Open the full sample report → Run your first audit free
Why not just ask the CMP

Nothing audits itself.

Your CMP reports what it was told to do. CookieTrail reports what the site actually did. The illustration below shows why cookie evidence and a saved consent record need separate review.

The CMP's own record
consentStateall-rejected categories0 / 4 on marketingdenied statisticsdenied

self-reported · nothing looks wrong

What the browser actually did
_fbppresent · .alpinesupply.co frpresent · .facebook.com IDEpresent · .doubleclick.net tag sourceneeds review · inspect the actual configuration

illustrative scenario · cookies present after rejection

It only sees what it controls

Not the hardcoded pixel, the ungated tag-manager trigger, or the tag another team shipped last quarter. Outside its blocking layer, it's blind.

It logs intent, not outcome

It sends “denied” and trusts the vendor to comply. Its record reads the same whether the pixel obeyed or fired anyway.

It decides what a Berliner sees

It never checks what a Berliner got. Configuration isn't verification — and a tool grading its own homework isn't an audit.

Both sides of the line

Too loose, your client carries the risk.
Too locked, you eat the loss.

Everyone audits one direction — the legal one. But a consent setup fails both ways, and the second failure is the one that lands on the agency.

⚑ Legal exposure — fires too much

The site tracks people who said no.

  • Ad pixels fire before anyone touches the banner
  • “Reject all” closes the banner — and changes nothing
  • The CMP defaults every category to accepted and calls it consent

Review the evidence with the client's privacy owner. Cookies and requests alone do not establish a legal violation.

◌ Measurement loss — fires too little

The site blinds the tools you report with.

  • Trackers stay blocked even after the visitor accepts
  • Consent settings may block intended analytics
  • Tags are installed, configured — and silent

Compare accepted-path activity with the client's intended event plan and analytics reports.

Compare the measured consent paths. CookieTrail records accepted and rejected visits so you can investigate differences. Your analytics tools and intended event plan establish which signals should arrive; browser evidence alone cannot measure lost conversions.
What to investigate

Turn observations into fix work.

A report separates what the browser measured from what your developer still needs to confirm. These are common investigation paths, not automatic legal verdicts.

before-choice cookies

Known analytics or advertising cookie names appear before a visitor chooses. Identify their writer and intended category before changing initialization.

stored-choice mismatch

An accept or reject action produces a readable record that differs from the requested choice. Inspect the handler and category mapping.

collection requests

Recognized collection endpoints receive responses before a choice or after verified rejection. Review the payload, consent signals and initiator.

incomplete choice

A control cannot be operated or its stored choice cannot be read. The report stays inconclusive and explains the missing evidence.

accepted-path activity

Compare recorded scripts, requests and cookies after acceptance with the event plan. Absence during a short visit cannot establish lost conversions.

fix verification

A fresh check compares the same page and location. A finding is no longer observed only when comparable evidence supports that outcome.

One URL, one chosen location, three fresh consent paths per customer check. Other pages, unknown endpoints, request payloads and server-side activity need separate investigation.

The engagement

Portfolio in, receipts out.

1

Add your client pages free

Start with a client site or your own. Choose the URL you want to check. No client access or script tags required.

2

Choose a visitor location free

Start with the market that matters to your client. Each audit covers one URL and one visitor location. Compare the launch plans and audit allowances.

3

Full audit on the sites that matter

Fresh residential browser sessions check first load, accept and reject. We record cookie identities, selected tracker requests, readable consent state and before/after screenshots. Missing controls or unreadable records are explained in the report.

cookie snapshotsconsent-record read-backrequest timing country verificationscreenshotsagent escalation
4

Review, export and verify

Share a Markdown or JSON export, or invite your team to the workspace. Copy fix briefs, track findings, and run a fresh check after your developer makes the change.

Honest to a fault, by design. If we didn't observe something, the report says so — no invented timelines, no “no banner found” over a screenshot of a banner, and never a click reported as successful without a readable stored choice. Cookie presence, request delivery and consent records are separate observations; request payloads and site source code still need review.

Keep whatever banner they have. CookieTrail is CMP-agnostic and outside-in — it doesn't replace OneTrust, Cookiebot or the rest. It's the independent check that says whether they're doing their job.

Articles & verification guides

Resources for checking your consent setup.

Learn the testing workflow, or find the checks for the CMP already on your site.

Start here

Start with one site.

Enter a client site or your own. Create your free account, choose a market, and send your first consent check off.

Start free · no card required Before consent · accept · reject Personal workspace included · team setup optional

Nothing to install, no client access needed. Keep whatever banner they have — CookieTrail is the independent check.