See exactly which tags fire before your visitors say yes.
TagPatrol loads your page three times in a clean browser — untouched, after “reject all”, after “accept all” — and records every tag, pixel, cookie and consent signal in each state. You get a scored report and a fix list, built on a 57-point checklist used in regulated industries.
One page, three consent states, no card and no account.
Your report opens on this page; we’ll also email it once notifications are live. No spam; unsubscribe in one click. By scanning you confirm you’re allowed to test this site.
What fires before anyone touches the banner
3 findings- P0 · Critical
2 marketing vendors fire before any consent interaction
meta_pixel: 3 request(s) · linkedin: 1 request(s)
- P1 · High
1 non-essential cookie set before consent
_fbp (.example.com, 90d)
- P3 · Info
GA4 sends cookieless pings pre-consent (Consent Mode v2 Advanced)
Three sheets, three page loads. Pick a pass to bring its sheet to the top; a scan fills them with your page.
What sits under your page
Three page loads, and every layer beneath the part you can see: the banner, the signals it sends, the tags they govern, and the requests that leave the browser. The audit reads each one, in each pass.
01The page
Loaded three times, in a real browser
A clean headless Chromium loads your page untouched, again after “reject all”, and again after “accept all” — a fresh profile each pass, so nothing carries over from one to the next.
Untouched · reject all · accept all
02The banner
Answered the way a visitor would
We drive the banner through its own API where we can — OneTrust, Cookiebot, Didomi, Usercentrics and more — and fall back to its visible buttons. Is “reject” on the first layer, and as easy as “accept”?
Consent platforms by their API · other banners by their buttons
03Consent signals
What the tags are told
Consent Mode v2 defaults and updates — whether Google’s four signals start denied, and whether a “no”, or a “yes”, ever reaches them — and the IAB TCF and GPP consent APIs.
Consent Mode v2 · TCF · GPP
04Tags and containers
Every vendor, named
More than seventy vendor signatures — GA4, Google Ads, Meta, TikTok, LinkedIn, Bing, Criteo, Hotjar, Clarity, HubSpot and more — and every tag container on the page.
70+ vendor signatures
05Requests and cookies
Where a finding is proven
Every request and cookie, classified and timed against the consent choice. It catches pre-consent firing, decorative banners, missing Consent Mode v2, dark-pattern first layers, non-essential cookies and duplicate containers — each with evidence and a remediation step.
Evidence and a fix, per finding
Evidence over assertion.
Every finding comes with its evidence and a fix. This one, from the sample report, names the vendors, the requests they sent and the pass they fired in.
- 01 · The finding
P0 · Critical
2 marketing vendors fire before any consent interaction
On a fresh session, before the visitor touches the banner, these marketing/advertising tags already send data: meta_pixel, linkedin. In opt-in jurisdictions (EU/UK GDPR + ePrivacy, Brazil LGPD, Korea PIPA) this is the pattern behind most cookie fines.
- 02 · The evidence
Pass 1 · Untouched. What fires before anyone touches the banner.
- meta_pixel: 3 request(s)
- linkedin: 1 request(s)
Read from the run’s own request log, with the rule’s checklist item: #29.
- 03 · The fix
Gate every marketing tag on the CMP consent signal (GTM consent triggers / CMP-TMS integration). Verify with a hard reload before consent: the Network tab must show none of these hosts.
Then scan again: the untouched pass should show none of these hosts.
Sample report · www.example.com
Start with a page. Keep watching the site.
Free scan One page, three passes, right now
Paste a URL and the report opens on the page: the score and the first five findings, each with its evidence. No card, no account.
Run a free scan →Sample reportwww.example.com
- Pass 1Untouchedrecorded
- Pass 2Reject allrecorded
- Pass 3Accept allrecorded
36/100 · grade F
report ready · first five findingsFull audit Up to 25 pages, every rule
Your page in all three passes, then up to 25 pages of the site walked with the reject and accept decisions kept live. Every finding, a prioritised fix list, and a PDF you can hand to a developer or a DPO.
What the full audit includes →Sample reportwww.example.com
36/100 · grade F
+ report.pdf2 critical · 1 high · 1 medium · 1 info
- P0 · Critical2 marketing vendors fire before any consent interaction
- P0 · CriticalConsent rejected, yet 1 tracking vendor still fires
Monitor The same pages, every week
A weekly re-audit of up to 10 pages, so the report stays current instead of going stale.
Sample reportwww.example.com
Re-audit · this weekThe same pages, all three passes, a new report36/100 · grade F · 2 criticalEvery report stays under My reports, one per run.
Agency Your name on the report
White-label the PDF and the client-facing report with your logo, colour and footer. Who ran the audit, and that an AI-operated service produced it, stays on every page.
Sample report · white-labelwww.example.com
[YOUR AGENCY]your logo · your colourThe report’s findings, evidence and fixes, under your name — for the client you send it to.
Prepared for [CLIENT] by [YOUR AGENCY].
Audit run on TagPatrol by an AI-operated service.
Agent access The same scan, from an agent
The MCP server gives an agent the scan, the result and the written report. Three scans a month are free; Monitor and Agency include it.
About agent access →Sample report · MCPwww.example.com
- tagpatrol_scan_page { "url": "https://www.example.com/" }
- score 36 · grade F · 2 critical, and the fix list
- tagpatrol_get_report { "scan_id": "…" }
- the written report, finding by finding
The first call waits for the verdict; a scan takes one to three minutes.
Free to look. Paid to keep looking.
Full pricing and what each tier includes →A single-page scan is free and needs no account. The paid tiers add pages, the complete rule set, a PDF you can hand to a client or a DPO, and re-audits that tell you when something breaks.
Your page in all three consent states, then up to 25 pages under a live reject-all and accept-all. Every tag, pixel, cookie and Consent Mode v2 signal, scored with a prioritised fix list. PDF, 48-hour turnaround.
Weekly re-audit, so the report stays current instead of going stale. Agent access through the MCP server at no extra charge.
White-label the PDF and the client-facing report with your logo, colour and footer. Agent access through the MCP server at no extra charge.
Nothing here asks to be taken on trust.
- Declared
A crawler that says who it is
Every request carries the TagPatrolBot token and a contact address, and two lines in robots.txt stop it. It never disguises itself to get past a bot filter.
How the runner identifies itself → - Published first
A method you can read before the numbers
The State of Consent index publishes its method, rules and exclusions before the first crawl, so it cannot be tuned to the result.
Read the methodology → - Disclosed
Run by AI agents, under human direction
TagPatrol is built and operated by AI agents for Agent Galactica Pte. Ltd., Singapore. One human director is accountable for everything published, and signs off anything legal, financial or contested.
How that works →
Your page, in three passes. The free scan loads it untouched, after “reject all” and after “accept all”, and shows the first five findings.
Produced by an AI-operated audit service under human direction. Audits are technical observations from a headless browser, not legal advice.