Free heuristic tool
Does your cookie banner actually ask for consent?
Paste a URL — or paste a page's HTML — and get a 0–100 heuristic score on the things regulators look at first: the banner, the consent platform, whether refusing is as easy as accepting, and whether trackers fire before anyone consents.
A quick disclaimer:this is an educational heuristic — static markup analysis, not legal advice and not a compliance audit. It can't see what scripts do at runtime or whether consent choices are honored. Read the score as questions to explore, not conclusions.
Why cookie banners matter
Québec's Law 25 requires consent to be manifest, free, and enlightened, given for specific purposes — in practice, prior opt-in consent before non-essential cookies or trackers fire. Pre-ticked boxes and “by continuing to browse you accept” don't meet that bar. The GDPR and the ePrivacy rules set the same opt-in expectation in Europe, and regulators on both sides of the Atlantic have moved from guidance to fines.
Most banners fail on the same handful of points: no real way to refuse, purposes you can't toggle individually, analytics firing on page load before anyone clicks anything. This auditor checks exactly those points — in seconds, from the page's public HTML.
How scoring works
Five categories, 100 points total. Each finding comes with a plain-language explanation of what was detected and what's missing. The methodology pagedocuments every signal, weight, and limitation.
25 pts
01Banner presence
Is there a consent banner in the page markup at all?
No banner usually means no opt-in moment — the first Law 25 question.
20 pts
02Consent platform (CMP)
Is a recognized CMP (OneTrust, Cookiebot, Didomi…) or IAB TCF signal in use?
A maintained CMP is the most reliable way to keep consent records and purpose toggles consistent.
20 pts
03Consent model quality
One-click reject-all, granular purpose controls, no pre-ticked boxes, no browsewrap language.
This is where most banners fail the opt-in bar — refusing must be as easy as accepting.
25 pts
04Pre-consent loading
Do analytics/advertising scripts fire before consent, or are they gated?
Trackers firing before consent is the classic Law 25 / GDPR failure mode.
10 pts
05Policy links
Can visitors reach a cookie policy (or privacy policy) from the banner?
Informed consent needs somewhere to read the details.
Grades
A to F
A (90+) Excellent · B (80+) Good · C (70+) Fair · D (60+) Weak · F (<60) Poor. A low score is a starting point for questions, not a verdict.
Two ways to audit
Audit a URL
Our server fetches the page's public HTML — SSRF-hardened (private and cloud-metadata IPs blocked, redirects re-validated), 8-second timeout, 2 MB cap, text documents only. The HTML is analyzed and not stored.
Paste page HTML
View Source, copy, paste. The exact same heuristics run 100% in your browser — nothing leaves your device, and it works even if the server endpoint is ever unavailable.
Go deeper
Methodology
Every criterion, weight, detection signal, and limitation — published so the score can be checked, challenged, and reproduced.
Embed kit
Copy-paste score badges and report cards for your own site or blog, with link-back to the full report.
Why this matters
Real CAI enforcement actions under Quebec Law 25 — what non-compliance has actually cost organizations.