Does your cookie banner actually ask for consent?

Québec's Law 25 requires consent to be manifest, free, and enlightened, given for specific purposes: in practice, prior opt-in consent before non-essential cookies or trackers fire. Pre-ticked boxes and “by continuing to browse you accept” don't meet that bar. The GDPR and the ePrivacy rules set the same opt-in expectation in Europe, and regulators on both sides of the Atlantic have moved from guidance to fines.

Most banners fail on the same handful of points: no real way to refuse, purposes you can't toggle individually, analytics firing on page load before anyone clicks anything. This auditor checks exactly those points: in seconds, from the page's public HTML.

A banner score cannot tell you whether the list in your consent platform matches the cookies a browser actually records. Platforms classify by the domain that set the cookie, so a Google Analytics cookie set on your own domain gets labelled first-party, even though Google receives the data. Vendors rename cookies, tags load other tags, and the declaration drifts.

Declared vs Observed closes that gap on your own device. Import a HAR file or a cookie export, paste the declaration from your platform, and get three lists: observed but not declared, declared and observed, and declared but not observed. Each cookie is classified twice, by setting domain and by receiving organisation, from a bundled knowledge base. Three guided checks cover what a file cannot show: whether trackers still fire after Reject, whether the platform is wiping and recreating the _ga cookie, and whether Google Analytics receives a g/collect request before anyone consents. The result exports as a register starter file you can govern from.

Nothing is uploaded. The import is read in your browser, raw cookie values are discarded as it is parsed, and the only thing you can store is a names-and-domains summary on your own device, with a one-click wipe.