What CookieGap scans for.

Detection signals

• Three-phase cookie capture

  Cookies set before consent, after accept, and after reject (with reload) — the full consent lifecycle.
• Consent-management-platform identification

  Detects 12 CMP vendors via window globals, DOM signatures, and CDN-domain fingerprints when JS detection is suppressed.
• Reject-button verification

  Locates the reject control via vendor JS API, DOM selector, ARIA, visible text (incl. shadow-DOM piercing), or settings-link fallback — and verifies post-action that consent state actually flipped.
• Necessary-cookie classification

  Excludes session, CSRF, CDN/security (Cloudflare, Akamai, Imperva, DataDome), CMP consent records, and opt-out signal cookies from violation counts under every framework.
• Third-party tracker identification

  Curated signature database matches tracker domains and assigns categories (analytics, marketing, advertising, functional, preferences).
• IAB TCF v2 inspection

  Reads TCF consent strings; flags legitimate-interest abuse on consent-required purposes.
• Do Not Sell or Share link detection

  CCPA/CPRA: detects presence and that the link leads to an actual mechanism.
• Privacy-policy link detection

  Locates a discoverable privacy policy from any page surface.
• Geo-targeted scanning

  Routes scans through residential proxies in 6 regions to test region-conditional consent behaviour.

Frameworks & deductions

Each scan is graded against the framework(s) applicable to its region. Below is every category of violation we deduct points for, by framework. Specific point values are not published.

Supported CMPs

Detected via window globals, DOM signatures, or CDN-domain fingerprints. 8 of these are also reachable through their native programmatic reject API for reliable opt-out testing.

Orange = native reject API supported · Grey = identification only

Documentation we can't audit

• Data Processing Agreements with vendors

  Whether you have GDPR Art. 28 / CCPA service-provider contracts in place with every third party that touches user data.
• Records of Processing Activities (Art. 30)

  Internal documentation of every processing purpose, recipient, retention period, and transfer mechanism.
• Data Protection Impact Assessments

  Mandatory risk assessments for high-risk processing under GDPR Art. 35, LGPD Art. 38, and equivalents.
• Lawful-basis appropriateness

  We detect whether consent appears to be obtained, but not whether the legal basis you have chosen for a given purpose is the correct one.

Backend behaviour we can't observe

• Server-side data flow

  Anything that happens after data leaves the browser — server-to-server pixels, CDP joins, ad-tech bid-stream propagation, data-warehouse exports.
• International data transfers

  Whether SCCs are signed, whether the recipient country is adequate, whether transfer impact assessments have been completed.
• Data retention enforcement

  Whether your systems actually delete personal data after the retention period you've published.
• Subject access request handling

  Whether your team can fulfil GDPR/CCPA access, deletion, and portability requests within the legal deadline.

Surfaces and signals we don't scan

• Mobile apps and native SDKs

  Web-only. iOS, Android, and embedded SDKs require different tooling.
• Authenticated user experience

  Scans run logged-out. Logged-in pages may load different cookies, e.g. preference scripts that only fire after sign-in.
• Email marketing & CASL

  Commercial electronic message rules (Canada's Anti-Spam Legislation) apply to email channels we don't touch.
• Global Privacy Control (GPC) signal honour

  We do not currently transmit Sec-GPC: 1 during scans nor verify that sites respond to it. Coming on the roadmap.
• COPPA age-gating flows

  We don't simulate child-user paths or test age-verification gates. COPPA compliance for sites with children's content needs separate review.

Where our analysis is shallow

• Privacy policy content quality

  We confirm a privacy policy exists. We do not parse it for completeness — disclosed recipients, retention periods, legal basis per purpose.
• CMP category-to-cookie mapping correctness

  We trust the CMP's own categorisation of trackers. If the CMP wrongly labels Google Analytics as 'Necessary', we won't catch it without manual review.
• Dark-pattern depth (beyond reject-button visibility)

  We detect missing reject buttons and pre-checked toggles. Subtler patterns — colour contrast manipulation, misleading copy, multi-step burials — need human review.
• Per-US-state legal nuances

  We grade US scans against CCPA equivalent. Sensitive-data opt-in differences in Virginia / Colorado / Connecticut / Texas, and Quebec Law 25 specifics, are not separately scored.