Supported technology and regulations

Start with a website privacy auditing tool, not a cookie scanner. The tool needs to show what each site does before and after a visitor makes a consent choice, and it should cover tracking pixels and network requests as well as cookies. Results should be judged against the law in each market and rolled up by brand and region. Cressive Privacy Compliance was built for exactly this kind of enterprise portfolio, with support for 14 named cookie banners, the main tag managers and analytics tools, and EU, UK and California law.

A traditional cookie scanner lists the cookies a site sets, mostly so they can go into the cookie banner and cookie policy. A website privacy auditing tool checks whether tracking actually stops when a visitor rejects. It also looks at pixels and other network requests, and says which requirement each finding breaks.

A useful cookie banner audit goes beyond checking that a banner appears. It should confirm visitors can actually see it, then test what happens when they reject, accept or opt out. Cressive Privacy Compliance runs these checks on 14 named cookie banners and on custom ones.

Cressive Privacy Compliance runs alongside OneTrust rather than replacing it. OneTrust collects consent, and Cressive Privacy Compliance checks independently whether each website respects it. That includes sites in the same portfolio that use a different cookie banner or one built in-house.

Test each site the way a visitor meets it. Record what loads before any choice, then reject and record again. Under the ePrivacy Directive and the UK’s PECR, anything that isn’t strictly necessary has to wait for consent and stop after a rejection. Cressive Privacy Compliance runs these checks automatically and flags the tracking that breaks the rule.

OneTrust, Usercentrics and Cookiebot, TrustArc, CookieYes, Osano, HubSpot, Termly, Tealium, Cookie Control by Civic, CookieFirst, CookieHub, BigID, NextRoll and Affino, along with 12 custom and in-house cookie banners.

It can be added in minutes. That includes cookie banners organisations have built themselves.

Yes to the first. Every audit checks that the banner actually appears on screen, so one that sits in the page code but never shows isn’t counted. A check on whether Accept and Reject get equal weight can be added to an audit.

No. The cookie banner collects consent, and Cressive Privacy Compliance checks whether the website respects it. It works the same way whichever cookie banner a site uses.

Cressive Privacy Compliance records every cookie, tracking pixel and network request a page uses and names the vendor behind each one. Results are split by consent state, showing what runs before consent, after a rejection and when an opt-out signal is sent. A sample report shows the format.

Load the page as a first-time visitor and record everything before touching the cookie banner. Cressive Privacy Compliance lists each cookie, pixel and request that fires at that point and flags the ones that need consent under the law that applies.

Cressive Privacy Compliance picks up advertising tracking such as Google Ads and Meta Pixel and shows which consent state it fired in. Each finding points to the tag manager or cookie banner set-up that needs to change.

Meta Pixel should only load after a visitor accepts marketing tracking. In most set-ups that means tying the pixel to the cookie banner’s consent signal inside the tag manager. An audit shows where the pixel fires too early and which container loads it. Rescan once the change is made to confirm it worked.

Not in itself. A tag manager usually has to load first, and it often delivers the cookie banner, so Cressive Privacy Compliance treats the load as functional. Whatever the tag manager sends after that is assessed separately.

Google Tag Manager, Adobe Experience Platform Tags (formerly Adobe Launch) and Tealium iQ, plus Google Analytics 4, Adobe Analytics, Matomo Analytics and Google Consent Mode v2.

That depends on the law, as the regulations comparison shows. GDPR requires consent first. UK rules allow basic statistical analytics before a choice, as long as visitors get a simple way to opt out. Under the CCPA, analytics the site uses only for itself isn’t a sale or a share. In all three, analytics that also feeds advertising is treated as advertising.

It’s analytics data that also ends up feeding advertising. Cressive Privacy Compliance gives it the same risk as advertising tracking.

Not always. Analytics can send details about a visitor’s device without setting any cookie, and most regulations still require consent for that.

Look at what Google tags send in each consent state. Cressive Privacy Compliance factors Google Consent Mode v2 into its assessment of Google tags, including whether advertising permissions were granted. If a set-up sends more than the visitor agreed to, the audit shows it.

GDPR is opt-in. Tracking that isn’t essential needs consent before it runs, and the cookie banner must offer Reject on the first layer. The CCPA is opt-out. A site can sell or share personal information without asking first, but it has to offer a clear opt-out link and honour it, Global Privacy Control included. So the same site can pass in California and fail in the EU. See how the regulations differ.

Cookies and similar technologies used only for statistics, to understand and improve a site, no longer need prior consent. Visitors must still be told about them and given a simple, free way to object. Advertising and personalisation still need consent, and anything non-essential has to stop once a visitor rejects.

Load the site with Global Privacy Control switched on and see whether selling or sharing stops. Every CCPA audit in Cressive Privacy Compliance includes this test, along with a check for a clear opt-out link.

Yes. Article 5(3) covers storing or reading information on a visitor’s device, and regulator guidance confirms it applies to tracking pixels and similar techniques as well as cookies. An automated scan shows what each site stores and reads before and after a consent choice, across every page and site in scope.

The ICO’s guidance on storage and access technologies covers cookies, tracking pixels and similar techniques. Organisations are expected to know what their sites store and access on visitors’ devices, and to get consent for anything that isn’t exempt. Sites change constantly, so regular automated audits are the realistic way to keep that picture up to date.

Add company policies on top of the regulation. That way one standard, GDPR for example, applies to every site in every country, along with internal rules such as approved cookie banners and a standard site set-up.

Each Cressive Privacy Compliance report is dated and shows what the site did in each consent state, with every finding linked to the requirement it breaks. The report covers what happens in the visitor’s browser. Vendor contracts, what happens to data after it leaves the browser and consent records are outside its scope.

Because the outcome and the score measure different things. The outcome records whether a requirement was broken. The score reflects how much non-compliant tracking there was. A single analytics cookie set before consent fails a site under GDPR but barely moves its score.

Yes, as long as it runs no tracking that needs consent. The CCPA doesn’t require a cookie banner at all. Company policies can set a higher bar, for example requiring a cookie banner on any page that loads a tag manager.

Cressive Privacy Compliance can audit a site as a visitor from any of 18 locations in Europe, North America, Asia-Pacific, South America and Africa. Audits can also be scheduled, so cookie banners that change by country keep being tested the way local visitors see them.

No. The visitor’s location and the regulation are set separately, and the report shows both.

Usually not. The scanner, CressivePrivacyBot, is listed as a verified bot in Cloudflare’s bot directory, and Cloudflare’s Bot Fight Mode lets verified bots through by default.