Enforcement self-test
Agreely provides an automated enforcement scan that verifies your zero-click configuration works as intended. This scan is a point-in-time verification: it proves enforcement was working at the time of the scan. It is not a permanent real-time runtime guarantee.
The zero-click scan
The enforcement scan opens your site in a headless browser (Chromium via Playwright), clicks nothing, and verifies:
- That only strictly-necessary cookies are present before any interaction.
- That the Consent Mode v2 signal is in default-deny mode before GTM loads.
- That the Agreely snippet with your site key is present.
- That no tracking script fired without consent.
A report lists any violations by name (for example:
_ga emitted before analytics category was granted).
An honest count, by kind
The report never mixes kinds. It separates cookies, storage keys (local/session storage) and plain tracker hosts contacted that deposit nothing. The wording reflects exactly what was found, for example:
- "1 non-essential cookie detected before consent"
- "3 non-essential storage keys detected before consent"
- for a mixed case: "N cookies and M storage keys, non-essential, detected before consent"
A storage key is never presented as a deposited cookie, and a contacted host that deposits nothing is not counted as a violation. When there is no drift, the report reads "No non-essential cookies before consent".
Running a scan manually
In the banner app, navigate to your site > Zero-click verification and click Check pre-consent blocking. The latest result shows on the same page, with the date of the next re-check. The scan typically completes in under a minute. (The Verify and scan button on the Installation page checks the tag and inventories the cookies; it does not replace this check.)
Staging origins
To test on your development or staging environment before deploying to production, add your origins under your site > Settings > Staging origins (one full origin per entry):
https://staging.yourdomain.com
http://localhost:3000
These additional origins (extra_origins) are accepted by the consent endpoint
and by the enforcement scan. The site key is the same; only the allowed origins
are extended.
Important. Staging origins are never exposed in the public banner configuration. They appear only in internal consent request validation and in scans.
Monthly drift check and alert
Agreely schedules a monthly drift scan for each verified website. If the scan detects a discrepancy from the expected configuration (for example, a new script that fires before consent), an email alert is sent to the account owner. One alert is sent per failure, so a still-failing site is not re-spammed.
The alert includes:
- The website domain concerned.
- The offenders by name, each with its kind (cookie, storage key, or tracker host) and its source host.
- A link to the installation page with the fix guidance.
- Honest wording: the scan is verified at a point in time, never a runtime guarantee.
What verification does not guarantee
- It does not guarantee that every scenario on your site is covered (the scan explores a subset of pages).
- It does not guarantee that your own server-side cookies are handled correctly (see Server side).
- A successful scan is not a compliance certificate. Your organization remains responsible for Law 25 compliance across all its purposes and processing.
Agreely helps document and demonstrate your posture; it does not substitute for your privacy officer's assessment or legal advice.