Site scan

The site scan shows what your website really loads. It combines three sources.

#1. Read my page

Privacyboard reads your page code and lists the known services it contains, with the exact tag change needed when a tag is written in the page. It does not see tools added after the page loads, for example by a tag manager.

#2. Open it in a real browser

Privacyboard opens your home page in a real browser three times: untouched, after Reject all and after Accept all. It reports which other websites the page contacted and which cookies were set in each case. This shows what runs before consent and whether refusal works. It checks one page: a spot check, not a full crawl.

#3. What visitors' browsers report

Once your banner is live, it reports from a sample of real visits which other websites the page contacted and which cookies were present, once per visit, about five seconds after load. No cookie values, no addresses and no visitor identifier are included. "Before choice" means before the visitor answered the banner.

#Reading the results

• One verdict. The tools contacted before visitors choose, from the real browser and from visitors' reports together, with the likely cause: a tag placed before the banner script, Cloudflare Zaraz, fonts loaded from another company, or a script only downloaded.
• To add to your services. Known tools that are not declared yet. Tools already declared are summed up in one line, which also tells you when a declared tool uses cookies your declaration does not list.
• No cookies, nothing to declare. Web fonts set no cookie, so the banner cannot ask about them. They still share the visitor's address with the font provider: hosting the fonts yourself avoids it.
• Technical details. Each address and cookie seen before a choice or after “Reject all”, addresses to identify, and your site's own cookies that are not in our list.

Earlier checks are read again with the current lists, so a tool identified since then no longer shows as unknown.

#Automatic weekly scan

Once your banner is published, Privacyboard checks your site in a real browser about once a week. You are emailed only when something is new compared with the previous check, for example a new tool loading before consent.

#FAQ

#Does the check log into my website?

No. It opens public pages only.

#Why does the scan not see my tag manager tags?

Tags a container loads are not visible in the page code. The real-browser scan and visitor reports show them once they run.

#Does the banner send anything before the visitor chooses?

It loads its own settings from Privacyboard, which is needed to show the banner. About five seconds after load it reports names of third-party websites and cookies it saw, with no values, no addresses and no visitor identifier. The visitor's choice itself is logged only when they make it.