Questions and answers

What does a test do?

It visits your site as a first-time visitor would, in a real browser, and runs 70+ checks on what it sees. In short: which tracking tools are installed and whether each one actually sends data; whether anything fires before the visitor has made a choice, keeps going after a reject, or ignores the banner altogether; whether tools are blocked, delayed, duplicated or misconfigured; and whether the site itself does anything that gets in the way of tracking. Each finding comes with the evidence and a fix.

Where is the test run from?

From the EU or the United States - you choose before starting. EU runs apply EU/UK consent rules; US runs apply EU/UK rules only when the site is aimed at European visitors.

Why can my result differ from what I see in my own browser?

• One run from one place. Sites show different banners, tags and ads by country, by visit and by A/B test.
• Ad auctions pick different partners on every page load, so the ad-tech tools in the list can change from run to run.
• Your own browser may already hold consent cookies, extensions or ad blockers. The test starts clean every time.

"Site blocked the test" - what does that mean?

The site's bot protection (Akamai, DataDome, Imperva and similar) refused an automated browser from a data-centre address. Nothing was measured, so the report shows no findings rather than guessing. A real visitor isn't affected.

If it's your site, you can allow the test browser: its requests carry the user agent token IsItTracking and are signed - see Our test browser for what to add to your allow-list.

What doesn't the test cover?

• Log-in, account, cart, checkout and purchase pages - it never follows those links, so purchase and conversion events aren't tested.
• Tags that fire after a long delay, on deep scrolling or on specific clicks.
• Anything that needs a logged-in user, a form submission or a specific region's banner.

Does it test "Reject"?

Yes - in a separate, fresh browser it clicks the banner's reject button (or a "continue without accepting" link) and checks whether tracking stops. When the first layer has no reject button, the report says so.

How long does it take?

About a minute; never more than 3 minutes. One test runs at a time - if the checker is busy, you'll be asked to try again in a minute.

Which tools and consent banners does it recognise?

120+ tracking tools (GA4, Google Ads, Meta, TikTok, Microsoft Clarity and UET, LinkedIn, Pinterest, Hotjar, Adobe, ...) and 30+ consent platforms (Cookiebot, OneTrust, CookieYes, Didomi, Usercentrics, ...). Requests that look like tracking but match nothing known are listed under "Unrecognised requests".

What do the statuses in the Tools table mean?

• Sending data - the tool sent data during the test.
• Loaded - a tag manager (GTM, Adobe Tags, Tealium) loaded. It sends no data itself; the tools it fires have their own rows.
• Blocked - every request the tool tried was refused, usually by the site's own Content-Security-Policy.
• Waiting for consent - set up with a consent check, and consent was never given in this test (no banner, or the accept couldn't be confirmed).
• Didn't fire - set up in GTM or the page, and at least one of its tags should have fired on the pages tested, but nothing was sent. Worth checking.
• Event-only - set up, but every one of its tags fires only on something the test doesn't do, such as a purchase, a form submit or a thank-you page. The row says which trigger. Usually fine.
• Not found - the tool is mentioned, but there's no ID and no tag for it, so nothing can load it.

What does line one mean?

Its first part answers whether tracking works ("Yes, tracking works.", "Tracking only partly works." ...); when a consent finding is High or Critical, a second part in the same size answers whether consent works - "But consent doesn't.", or "Consent doesn't work either." after a worse first part.

What does 'Sending data' mean?

Sending data means the request left the browser. Whether the platform processed it, we can't confirm.

How do you decide how serious a consent finding is?

Every finding about tracking before consent, or after a reject, starts with what the tool did, and that decides its severity:

Sent identifying data (an ID in the request, like a client ID or a browser ID) - Critical.

Set a new cookie - Critical for an advertising or marketing cookie (ad and social pixels, Google Ads, session recording); High for an analytics or testing cookie.

Sent requests with no identifier - High: the request still carries the IP address and browser details to a third party before consent.

Kept sending its own identifier after a reject (a cookie the tool set earlier in the test) - Critical.

Used a cookie another tool or the site set - Medium (High for a session recording).

What are Minor issues?

Things that lose no data today but show the setup hasn't been tidied - a discontinued tool still loading, a warning a tool logged on a page view. Needs attention is for findings that cost data or consent.

Can I share a report?

Yes. Share in the report header gives you the link - anyone with it can open the report, it's unlisted, and it stays available for 24 months. Copy as task gives the findings as plain text for a ticket or a developer.

Why is there a bot check when I start a test?

Each test runs a real browser for up to 3 minutes, so Run test is protected by a short bot check. Usually it passes without you doing anything. Opening the page sends nothing to the check's provider - it only loads when you start a test.

Does the UK's new cookie exemption change the results?

Since 5 February 2026 the UK's PECR (amended by the Data (Use and Access) Act 2025) lets cookies used only for statistics to improve a site run without consent, as long as they don't significantly affect visitors and visitors get clear information and a simple way to object. Advertising and cross-site tracking still need consent. For sites aimed at UK visitors, an analytics or testing tool (GA4, Clarity, Hotjar, A/B testing) sending data before consent is reported as High instead of Critical, with a note that the exemption may apply - unless the test sees GA4 sharing data with Google Ads (Google Signals, audience hits, Ads tags), where it stays Critical. Ad and social pixels are unchanged. The ICO hasn't published guidance on the exemption yet, so this is how the report is worded, not a separate UK rule set.

Is this legal advice?

No. It's an automated check of one test run. Use it to find what to look at, then check with whoever handles your privacy compliance.

What happens to my data?

See the Privacy page: what's stored per test, for how long, and who processes it.

I think a result is wrong.

Use "Report this result" next to the report - it goes straight to us with the run attached.