Most compliance tools want your email before they will tell you anything. We took the opposite approach and put five of ours behind no signup at all. You can check a site, look up a tracker, test your Google signals, generate a cookie declaration and migrate off another platform without creating anything.
Here is what each one does, and which to reach for first.
1. What actually fires on your site before consent?
The GDPR scanner loads your site the way a first time visitor's browser does and records everything that happens before any consent is given. Cookies set, trackers loaded, third party domains contacted. Results in about ten seconds, with a risk level on each finding.
Start here. Everything else is easier once you know what is on the page. Most people are surprised, and the reason is almost always the same: a plugin, a theme or an embed brought something along that nobody chose.
We have run this across 1,775 sites and published the aggregate results. The headline from that GDPR compliance study is that 30% of sites set a tracking cookie before consent, and sites with a banner did it more often than sites without one.
2. What does this cookie actually do?
The tracker database covers over 85 trackers with the cookies each one sets, who owns it, what category it falls in, and a GDPR risk level. Searchable and filterable, with a page per tracker.
This is the lookup tool for the moment you find _ga or _fbp in your cookie list and need to write a purpose for it. The entries come from the same definitions the scanner matches against and the cookie tables we publish in customers' privacy policies, which is deliberate. We would rather have 85 accurate entries than a few thousand guessed ones.
3. Are your Google consent signals correct?
The Consent Mode v2 checker reads the consent signals your Google tags actually receive. It reports whether all four required signals are declared, whether they default to denied, and whether they are set before your Google tags run. Fifteen seconds, no account.
Consent Mode fails silently, which is what makes a checker worth having. There is no console error when ad_user_data is missing, and the banner keeps working perfectly for everyone who clicks it. Our post on Consent Mode v2 not working covers what to do with each result.
4. Where does your cookie declaration come from?
The cookie policy generator turns a scan of your domain into a publishable cookie declaration: each cookie with its provider, purpose and duration, filled in from the tracker database rather than left as blanks for you to research.
If you are already a Consentify customer, there is a better version. Drop <div id="consentify-cookie-declaration"></div> on your privacy page and the declaration is generated from your configured integrations, so it updates itself when you add or remove one. Static tables go stale within weeks. This one cannot.
5. Moving off another consent platform
The migration CLI is the developer tool of the set. Run npx consentify-migrate in your project folder and it reads the codebase, works out your framework, removes the consent tool you have now, picks up your existing analytics and marketing tags, and puts the Consentify banner in the correct file.
It recognises Cookiebot, OneTrust, CookieYes, Iubenda, Usercentrics and a dozen others. It knows where the banner belongs in Next.js, Nuxt, SvelteKit and a WordPress theme. And it commits to its own git branch, so you review a diff instead of trusting it.
For agencies, the useful part is that you can point it at a folder of client sites and it handles every one in a single run, with a report at the end. If one site fails, the rest keep going. There is more detail on how the migration works, and it is free and open on npm whether or not you end up paying us anything.
Where should you start if you have ten minutes?
Run the scan, then the Consent Mode checker. The scan tells you what is loading before consent, and the checker tells you whether the biggest of those trackers is being instructed correctly. Between them you will know whether you have a real problem or a tidy up job, and neither needs an account.
If the scan comes back clean, that is a genuine result and you can stop. If it does not, our guide to fixing the trackers a scan finds goes through the common ones in order.
Why give these away?
Fair question. Partly because a scan result is a better argument than a landing page: it is easier to see the problem on your own domain than to read about it. Partly because the tools are built on infrastructure we run anyway for the product.
And partly because the free plan works the same way. One domain, no watermark, no pageview limit, no time limit. Not a trial. If the tools are useful and the product is not for you, that is a fine outcome, and you keep the tools.
Start with the scan, it takes about ten seconds. See what runs on your site before consent.