✦ Up to 95-point compliance checklist

Is your website leaking data before consent?

ConsentIQ audits your GTM setup, GA4 configuration, and consent management in minutes. Know exactly where you stand — before regulators do.

Run a Free Scan See What We Check
No account required
Results in under 2 minutes
GDPR · CCPA · CTDPA
A team auditing a website for consent compliance — checklist, magnifying glass over a verified checkmark, and a security shield.
US Enforcement — 2026

Regulators Are Acting. Companies Are Paying.

Enforcement under CCPA and US state privacy laws accelerated sharply in 2026. These are real penalties for the same consent failures ConsentIQ detects.

CCPA · California AG February 2026
$2.75M

Disney / ABC

Disney failed to honour opt-out requests across its streaming services and ignored Global Privacy Control (GPC) browser signals — requiring users to opt out separately on every device. At the time, California's largest CCPA settlement ever.

Read the AG announcement →
CCPA · CalPrivacy March 2026
$1.1M

PlayOn Sports

The operator of the GoFan digital ticketing platform — used by schools, parents, and students — was fined for deploying tracking technologies and targeted advertising without a working opt-out mechanism or compliant consent notice.

Read the analysis →
CCPA · CalPrivacy March 2026
$375K

Ford Motor Company

Ford was penalised for adding unnecessary friction to its consumer opt-out process — burying the opt-out behind multiple confusing steps. The CPPA ruled that making it harder to opt out than to opt in is itself a CCPA violation.

Read the CPPA decision →
CCPA · California AG May 2026
$12.75M

General Motors / OnStar

The largest CCPA penalty on record. GM collected precise geolocation and driving behaviour data from hundreds of thousands of consumers and sold it to data brokers — without adequate notice or consent. The first CCPA data minimisation enforcement action.

Read the AG announcement →

What ConsentIQ Checks

Three core modules always run. Additional modules run only if the relevant technology is detected on your site.

Consent Audit
Banner rendering, pre-consent tag firing, Consent Mode v2, OneTrust handshake, cookie categorisation, privacy-policy presence, dark-pattern detection. 27 checks.
Always checked
GA4 Configuration
Consent gating, Consent Mode v2 parameters, duplicate tags, debug mode on production, measurement ID, PII-in-payload detection. 14 checks.
Always checked
GTM Container
Tags without consent prerequisites, missing variables, custom HTML tags, trigger conflicts, UA remnants, SRI on external scripts. 17 checks.
Always checked
Adobe Analytics
Post-consent firing, duplicate AA tags, report suite ID, AppMeasurement version, dual-tracking detection. 10 checks.
If detected
Floodlight / CM360
Post-consent firing, PII in URL parameters, duplicate activities, Consent Mode parameters. 7 checks.
If detected
Social Pixels
Meta Pixel, LinkedIn Insight, TikTok, Pinterest — consent gating, duplicates, GTM prerequisites. 10 checks.
If detected
Cookie Security
Secure flag, HttpOnly, SameSite attributes on consent and analytics cookies, HTTPS, undisclosed cookies, excessive expiry, broad domain scope. 10 checks.
If cookies present

How It Works

1

Enter your URL

Paste your website URL and email address. No account needed.

2

Full scan runs

We audit consent, GTM, GA4, and any additional tags detected on your site.

3

Get your score

Instant compliance score with pass/fail per module. Full detail available with a paid report.

Expert-led — not just automated

Backed by over 20 years in tag management & analytics

ConsentIQ isn't a generic cookie scanner. Behind every finding is more than two decades of hands-on work with the systems your compliance now depends on — Google Tag Manager, GA4, Adobe Analytics, and consent platforms like OneTrust. The regulations are new; the technical depth to implement them correctly isn't. And we don't just flag what's wrong — we can fix it.

20+
years implementing GTM, GA4 & Adobe Analytics
95
point GTM / GA4 / consent-specific check suite
✓
We fix it for you — the audit is the start, not the end

Free Scan vs Full Report

Free Scan

  • Overall compliance score
  • Tags firing pre-consent (count)
  • Cookies set pre-consent (count)
  • Module pass/fail badges
  • Specific violation details
  • Legal risk per finding
  • Remediation steps

Full Report — from $500

  • Everything in the free scan
  • All finding titles + explanations
  • Legal risk per finding (GDPR / CCPA / CTDPA)
  • Step-by-step remediation instructions
  • Priority order — what to fix first
  • Downloadable PDF report
  • Option to have our team implement the fixes

Run Your Free Compliance Scan

No account required. Results in under 2 minutes.

Please tick the checkbox to continue.

Frequently asked questions

ConsentIQ runs up to 95 checks across seven modules: Consent (GTM, GA4, and consent banner behaviour), GA4 configuration, GTM container hygiene, Adobe Analytics, Floodlight/CM360, Social Pixels (Meta, LinkedIn, TikTok, Pinterest), and Cookie Security. Every site gets the three core modules; optional modules run only if those tags are detected.

Yes. ConsentIQ audits whatever consent setup your site has — OneTrust, Cookiebot, CookieYes, a custom banner, or nothing at all. It doesn't require or recommend any specific platform. The audit tells you what's working, what's broken, and what's missing.

Every report cites all applicable frameworks: GDPR (EU/UK), UK PECR, CCPA/CPRA (California), CTDPA (Connecticut), and NHPA (New Hampshire). No jurisdiction selection required — the audit identifies which regulations apply to each finding automatically.

The free scan shows your overall compliance score, a pass/fail badge for each module, and one teaser finding per module. The full report unlocks every finding — titles, plain-English explanations, legal risk language, remediation steps, and a downloadable PDF. Higher tiers include a remediation guide and our team implementing the fixes for you.

Under two minutes for most sites. Some consent-persistence checks require a second browser pass, which adds a little time. Sites with bot protection may need an allowlisting step for authorised (paid) scans.

Yes. The full-service engagement tier includes our team implementing all recommended fixes directly in your GTM container, GA4 configuration, and consent platform. You get the audit report, a plain-English remediation guide, and the implementation work — without needing a developer or another agency.
Talk to an expert

Questions before you scan?

Not ready to run a scan, or want to talk through your setup first? Send a note and we'll get back to you personally — no sales bot, no queue. Ideal if you're weighing a full audit or want our team to handle the fixes.