Your cookie banner says one thing. Your browser does another.

Almost every privacy enforcement action against a website starts the same way: someone opens the site with developer tools running and watches what loads before anyone clicks "Accept". The banner is not the evidence. The network log is.

The rule that catches most sites

Under EU law the principle is narrow and unforgiving: storing information on, or reading information from, a visitor's device requires prior consent unless it is strictly necessary to deliver the service the visitor asked for. Analytics is not strictly necessary. Advertising pixels are not strictly necessary. A/B testing is not strictly necessary.

The word that does the work is prior. A tag that fires while the banner is still on screen has already broken the rule, no matter what the visitor clicks a second later. And this is exactly the failure mode that a consent management platform does not fix by itself — a CMP blocks what it has been told to block. Anything loaded by a hard-coded script tag, injected by a third-party tag manager, or added by a marketing colleague last quarter runs outside its control.

Why this keeps being found

• Regulators automated the checking. Supervisory authorities now run crawlers that visit sites and record pre-consent network activity at scale. Detection no longer depends on a complaint.
• Refusing must be as easy as accepting. A banner with a prominent "Accept all" and a refusal buried two screens deep is a recognised violation in its own right, independent of what actually fires.
• Third parties change under you. An embedded video player, a font host, a chat widget or a maps embed may start contacting new endpoints after a vendor update. Nothing changed in your codebase, and your site's behaviour changed anyway.
• Transfers travel further than teams expect. A single tag can move IP addresses and device identifiers to infrastructure outside the jurisdiction you documented in your privacy notice.

What PrivaScan measures

PrivaScan is a product of Talivio Technology OÜ, the company that also publishes Talivio News.

• Real-browser, pre-consent detection. The site is loaded in an actual browser and every tracker, cookie and third-party request that runs before consent is recorded. This is the observation regulators make, made on your own site first.
• Cross-border transfer mapping — which requests leave the jurisdiction, and to whom.
• Whole-site crawling, because the home page is usually the cleanest page on the domain. Checkout, search and article pages carry the tags.
• Reports mapped to GDPR, ePrivacy and KVKK, delivered as PDF with a SHA-256 checksum, so a report can be shown to be unaltered.
• Continuous monitoring with new-tracker alerts, which is the part that matters most: the common failure is not a site that was never checked, but a site that was cleaned once and drifted afterwards.
• Concrete developer fixes rather than a findings list with no owner.

What a scan does not do

It is worth being precise, because the opposite claim is common in this market. PrivaScan is a detection and reporting tool. It does not make an organisation compliant and it does not sign off a legal position. It reports what a browser actually observed, on the pages it visited, at the time it visited them. Whether a given tracker is lawful in your specific context — what your legal basis is, what your notice says, what your contracts allow — remains a legal assessment.

What the scan removes is the excuse of not knowing. In practice most findings are not disputed once someone looks at the network log; they were simply never looked at.

See PrivaScan →