Violation & Fingerprinting Detection
Identifies pre-consent trackers, covert fingerprinting techniques and storage abuse — the exact patterns regulators flag, captured at the network layer.
Free tool · No sign-up
Run a free scan
GDPR · ePrivacy · CCPA
Is your website actually compliant?
ComplianceMonitor.io scans any URL and flags every cookie, tracker and third-party request that fires before the visitor gives consent.
Run a free compliance scan
Paste any URL. We'll load it in a real browser and report every cookie, tracker and third-party request that fires before consent.
Features
The whole picture, not just the banner.
A cookie banner is the visible 5%. The other 95% is what your visitors' browsers actually do before they get a choice.
Compliance Regression
Tracks compliance over time. Get alerted the moment a new tag, vendor or marketing tool quietly breaks what was already approved.
Jurisdiction Compliance
Audits the same URL against GDPR, ePrivacy, CCPA, LGPD and Greek Law 4624/2019 — each framework, each region, in one report.
Evidence & Evidence API
Every finding ships with timestamped network proof. Pull it via the Evidence API into your DPO workflow, legal hold system or audit log.
Resources
Dark patterns, trackers, laws and lingo — decoded.
Four references that sit behind every scan: the deceptive UX patterns we flag, the trackers we recognise, the regulations we audit against, and the vocabulary your team needs to talk about all of it.
Consumer protection
Dark Patterns Encyclopedia
Websites often employ psychological tricks to force users into decisions they didn't intend to make. ComplianceMonitor.io detects these deceptive design patterns during every scan.
Asymmetric Buttons The 'Accept' button is visually much more prominent than the 'Reject' button, nudging users toward acceptance. High
What is this pattern?
A website makes the 'Accept All' button visually dominant — bright color, larger size — while the 'Reject All' or 'Settings' button is minimized, greyed out, or disguised as plain text. This tricks users into accepting tracking because they assume it's the only primary action.
What Not To Do
Using deceptive layouts, hiding options, or manipulating the user's focus away from privacy-preserving choices.
How To Fix It
Ensure both 'Accept' and 'Reject' buttons have equal visual weight, size, and contrast. Neither choice should be visually prioritized over the other.
Hidden Reject Option The option to decline is buried in secondary menus or written in extremely small text. Critical
What is this pattern?
The option to decline non-essential cookies is buried in secondary layers or menus. Users are forced to click 'Settings', navigate through multiple screens, and uncheck boxes manually, whereas accepting takes just one click on the first layer.
What Not To Do
Using deceptive layouts, hiding options, or manipulating the user's focus away from privacy-preserving choices.
How To Fix It
Provide a clear 'Reject All' button on the first layer of the consent banner, right next to the 'Accept All' button.
Cookie Wall Interfaces that completely block access to content unless the user accepts all tracking cookies. High
What is this pattern?
A cookie wall is a strict barrier that prevents users from accessing any part of a website unless they consent to the use of cookies and trackers. This violates the principle that consent must be freely given.
What Not To Do
Using deceptive layouts, hiding options, or manipulating the user's focus away from privacy-preserving choices.
How To Fix It
Allow users to consume the basic content of the website even if they refuse non-essential cookies. Do not gate content behind mandatory tracking.
Pre-checked Categories Non-essential cookie categories are selected by default before user consent, violating opt-in requirements. Medium
What is this pattern?
When a user opens the cookie 'Settings' panel, categories for marketing or analytics are already checked by default. Under GDPR, silence or inactivity does not constitute consent; it requires a positive, opt-in action.
What Not To Do
Using deceptive layouts, hiding options, or manipulating the user's focus away from privacy-preserving choices.
How To Fix It
All non-essential cookie categories must be unchecked by default. Users must actively select them to give valid consent.
What are Dark Patterns?
Dark patterns are deceptive UX techniques in cookie banners and consent interfaces designed to manipulate users into accepting tracking. Under GDPR Article 7 and ePrivacy Directive, consent must be freely given, specific, informed, and unambiguous — dark patterns violate these requirements.
Web tracking scripts
Tracker Library
Which scripts do the websites you visit load? How do these tools process your data? Explore the web's most popular trackers and their privacy implications.
Google Analytics
_ga
The most widely used tool for tracking user behaviour and website traffic.
Analytics
Privacy risk · Medium
While primarily statistical, IP addresses must be anonymised and explicit consent is required under GDPR before the script loads.
What does it do?
Collects statistical data on how visitors interact with the website. It tracks session duration, pages visited, bounce rate, and user acquisition channels.
Technical details
Google Analytics uses first-party cookies (like _ga) to distinguish unique users. It can share data with Google Signals for cross-device tracking if enabled by the site owner.
Browser
google-analytics.com
Facebook Pixel
_fbp
Used by the Meta ecosystem to target ads and measure campaign performance across the web.
Advertising
Privacy risk · High
Meta aggregates this data to profile users across thousands of websites. It strongly requires explicit user opt-in before execution.
What does it do?
Tracks conversions from Facebook ads, optimises ad delivery, builds targeted audiences, and retargets users who have previously interacted with a website.
Technical details
The _fbp cookie identifies users for advertising purposes across the web. It sends events (like AddToCart or PageView) directly to Meta's servers.
Browser
facebook.com/tr
Hotjar
_hjSessionUser
Provides analytics through screen recordings and click heatmaps for UX analysis.
Session recording
Privacy risk · High
If not configured correctly, session recorders can capture Highly Sensitive Personal Information (PII) directly from the screen.
What does it do?
Records mouse movements, clicks, scrolling activity, and keystrokes to help site owners understand user behaviour visually.
Technical details
Hotjar sets cookies like _hjSessionUser to persist session data. It is crucial to suppress keystrokes in password or credit card fields.
Browser
static.hotjar.com
OneTrust
OptanonConsent
A platform used by domains to manage cookie banners and user consent preferences.
Consent management
Privacy risk · Low
Low direct risk. However, if implemented improperly, it may signal compliance while background trackers still fire (Pre-Consent Tracking).
What does it do?
Displays cookie banners, collects user consent preferences, and blocks other scripts until consent is given.
Technical details
Sets cookies like OptanonConsent and OptanonAlertBoxClosed to remember user choices across sessions.
Browser
cdn.cookielaw.org
Methodology note
Tracker identification is based on network request analysis during automated browser scans. Each tracker's privacy risk is assessed based on data collection scope, cross-site tracking capability, and third-country data transfer potential.
Legal compliance
Regulations Hub
Global privacy laws can be complex. We break down exactly what each framework expects from your website and explain user rights in plain language.
GDPR European Union General Data Protection Regulation. The toughest privacy law in the world — sets the global baseline that most other frameworks follow.
General Data Protection Regulation
Overview
The toughest privacy and security law in the world. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organisations anywhere, so long as they target or collect data related to people in the EU. Non-compliance can result in fines up to €20 million or 4% of global revenue.
Key website requirements
- Explicit, informed, and prior consent before deploying non-essential cookies.
- The right to easily withdraw consent at any time.
- Clear, plain-language privacy policies.
- The right to data portability and the right to be forgotten.
- Data Protection Impact Assessments (DPIA) for high-risk processing.
UK GDPR United Kingdom The UK's post-Brexit adaptation of the GDPR, enforced by the ICO. Same backbone, separate enforcement track.
United Kingdom General Data Protection Regulation
Overview
After Brexit, the UK retained the GDPR by incorporating it into domestic law as the 'UK GDPR', supplemented by the Data Protection Act 2018. It is enforced by the Information Commissioner's Office (ICO) and maintains broadly similar requirements to the EU GDPR, with some UK-specific adjustments for adequacy decisions and international transfers.
Key website requirements
- Lawful basis required for processing personal data (consent, legitimate interest, etc.).
- Individual rights: access, rectification, erasure, portability, and objection.
- Mandatory Data Protection Officer (DPO) for certain organisations.
- International transfer restrictions with UK-specific adequacy assessments.
- ICO can issue fines up to £17.5 million or 4% of global turnover.
CPRA California, USA California Privacy Rights Act — expands the CCPA with stricter consumer protections and a dedicated regulator.
California Privacy Rights Act (amending CCPA)
Overview
An evolution of the CCPA, the CPRA introduced the California Privacy Protection Agency (CPPA) as a dedicated enforcement body and expanded consumer rights. Unlike GDPR's opt-in model, the CPRA uses opt-out mechanics but places strict requirements around the sale and sharing of personal information.
Key website requirements
- A clear 'Do Not Sell or Share My Personal Information' link on the homepage.
- Honouring Global Privacy Control (GPC) browser signals automatically.
- New category of 'Sensitive Personal Information' with additional protections.
- Strict limitations on processing data of minors under 16.
- Annual cybersecurity audits and risk assessments for high-risk businesses.
PIPA South Korea Personal Information Protection Act. South Korea's strict data protection regime — one of the most demanding consent regimes in Asia.
Personal Information Protection Act
Overview
South Korea's strict data protection regime, considered one of the most rigorous in Asia. Enforced by the Personal Information Protection Commission (PIPC), it requires explicit and granular consent for data collection and imposes heavy penalties for violations.
Key website requirements
- Consent must be separate and distinguishable from other matters in agreements.
- Mandatory Privacy Impact Assessment for certain large-scale processing activities.
- Strict pseudonymisation and de-identification standards for data use.
- Cross-border transfer requires explicit consent or PIPC-approved safeguards.
- Criminal penalties can apply in addition to administrative fines.
Disclaimer
The information on these pages is for educational purposes only and does not constitute legal advice. Consult a qualified legal professional for compliance guidance specific to your organisation.
Dictionary
Privacy Glossary
Confused by the jargon in data protection laws and tech discussions? Use our glossary to understand complex privacy terminology in plain language.
- Consent Management Platform CMP Tooling
- Software that helps websites obtain, manage, and store user consent for data collection — typically surfaced through a cookie banner.
- First-Party Cookie
- A cookie created and stored directly by the website the user is currently visiting — often used for essential site functions like authentication.
- Third-Party Cookie
- A cookie created by a domain other than the one the user is visiting — commonly used for cross-site tracking and advertising.
- Browser Fingerprinting Tracking
- A technique that collects information about a user's browser and device (screen resolution, installed fonts, OS) to create a unique identifier without using cookies.
- Pre-Consent Tracking Violation
- The illegal practice of loading trackers or setting cookies before the user has explicitly interacted with a consent banner and opted in.
- CNAME Cloaking Tracking
- A technique used by trackers to disguise themselves as first-party requests by using subdomains that technically resolve to third-party servers.
- Data Controller Legal role
- An entity that determines the purposes and means of processing personal data. Under GDPR, companies are typically the data controller for their users' data.
- Litigation Exposure Index LEI ComplianceMonitor.io metric
- A ComplianceMonitor.io metric that quantifies the legal risk a website faces based on its tracking practices, violations found, and the regulatory framework applicable to its users.
Note
This glossary is maintained for educational purposes and may not cover every term. Definitions are simplified for accessibility and do not constitute legal interpretation.
How it works
A real browser. Real conditions. No shortcuts.
Three steps. No accounts, no SDK, no JavaScript on your site. Just paste a URL and let a fresh Chromium session do what regulators do: visit you cold and watch what fires.
-
You paste a URL
Any page on the public web. We never ask for credentials, analytics access or a tag on your site.
-
A real browser visits
Fresh Chromium session, EU IP, no prior consent stored. Every request, cookie and storage write is captured at the network layer.
-
You get a verdict
A scored report with concrete violations, the regulation each one breaks, and timestamped evidence ready for your DPO or legal team.
What actually happens before consent
Real results from 10,000+ website scans.
Anonymized scans of widely used services. Industry, not brand — but every number is real, captured at the network layer.
Major streaming service
streaming-platform.example
F
74third-party trackers
Pre-consent tracking detected
5violations found
74 trackers active · 5 compliance violations
Leading news network
news-network.example
D
184third-party trackers
Pre-consent tracking detected
7violations found
184 trackers active · 7 compliance violations
Top business network
business-network.example
D
60third-party trackers
Pre-consent tracking detected
3violations found
60 trackers active · 3 compliance violations
Global social platform
social-platform.example
D
21third-party trackers
Pre-consent tracking detected
1violation found
21 trackers active · 1 compliance violation
Why this matters
A clean banner doesn't make a site compliant.
Most websites pass a glance and fail a scan. Tag managers fire on page-load, analytics phone home before the banner paints, and pixels drop cookies the moment the visitor arrives. Regulators look at the network — and so do we.
- Average pre-consent trackers per scanned site: 14
- Sites with reject-all parity in the banner: 31%
- GDPR fines issued for cookie violations since 2020: €1.7B+
Verdict
Not compliant
Pre-consent loads
23
Reject-all parity
Missing
Consent Mode v2
Not wired
Cookie policy
Found
Frequently asked
The questions everyone asks first.
Is it really free?
Yes. No card, no account, no trial. Run as many scans as you like. We may rate-limit very heavy use from a single IP to keep the service fair.
Do you store the URLs I scan?
Reports are kept for 30 days so you can re-open the same link, then permanently deleted. We don't publish or index them anywhere.
Is this legal advice?
No. ComplianceMonitor.io is a technical scanner. It tells you what your site does. Whether that breaks the law in your jurisdiction is a question for your DPO or lawyer — and our reports are designed to be the evidence they need.
Can I scan a staging or password-protected site?
Today we only support publicly reachable URLs. Authenticated scanning is on the roadmap — get in touch if you have a real use case.
Will fixing the report make my site faster?
Almost always, yes. Blocking trackers before consent removes dozens of third-party requests from the critical path — most clients see Largest Contentful Paint drop by 200–600ms.
Start your first scan in seconds.
No setup required. Paste a URL, hit scan, and see exactly what tracking fires before your visitors give consent.
Free forever · No credit card required · Results in ~30 seconds.