We built this because
our clients started getting sued.

The letter

In 2026, a client of ours was sued under a California wiretapping law. They are not in California. They had a cookie notice on their website — the kind that announces cookies are in use and does nothing else. Their own in-house lawyer had reviewed it and signed it off, because at the time it looked like what everyone else had.

Nobody in that chain had heard of CIPA. It's a law written about telephone tapping decades before the web, later extended to electronic communications, and it reaches any website a Californian can open. There's no revenue threshold and no minimum customer count — none of the things that keep a small business outside other privacy laws apply. A banner that announces tracking rather than stopping it offers no protection at all. That's exactly the pattern these claims are built on.

Then it happened again

A few days later we found out a business in our own family was being sued for the same thing. By the same person.

That's when it stopped looking like bad luck. What we found was a pattern: people working through American small-business websites in volume, looking for exactly this — tracking running, and a banner that doesn't stop it — and sending letters. Not one letter. Campaigns of them. The businesses on the receiving end were nonprofits, business-to-business companies, small shops. People who had never been told the law existed, being asked to pay for not knowing.

We wanted to put a stop to it. That's the whole reason this company exists.

Then we looked at our own site

The uncomfortable part came next.

We build and look after websites for a living, so the first thing we did was check our own. We ran the scan that came with our cookie consent plugin. It said we were clean.

We weren't. Our site was running a screen recorder — the kind of script that captures what a visitor types, where they move their mouse, how far they scroll. It is exactly the technology named in these lawsuits. Our scanner never saw it, because it wasn't watching the page. It was matching addresses against a list of known companies, and this one either wasn't on the list or wasn't marked as risky.

We opened the browser's developer tools and watched it start up before the banner had been touched.

That gap — between what the tool reported and what the browser actually did — is the entire reason Consentinel exists as a product rather than a checklist.

So we built something that watches

Not a scanner. Something that visits.

It loads your site in a real browser, twice. Once as a visitor who refuses cookies, once as a visitor who accepts them. It watches every request each version makes. No list, no assumptions — just what the page actually did. Companies it doesn't recognize don't get dropped; they go into a bucket labelled “unknown companies we saw,” because the ones nobody has cataloged are the ones that caught us.

Then we pointed it at our own site again.

On a 173-page check in August 2026, that screen recorder ran 972 times. Every single one of them after the visitor agreed. The thing that started all this can't move now until someone says yes — and we can show it, page by page, with a date on it.

That same check still came back exposed, and we're not going to bury that. Seven trackers were still running before consent: fonts pulled in by style files, and a beacon added by our own hosting provider. Nothing any tool of this kind can reach, ours included. They're on our own report, about our own site, in exactly the place we'd put yours.

What we decided not to do

We could have built the same list-based scanner everyone else ships and called it done. It's cheaper to build and easier to sell. It would also have told us our own site was clean.

We didn't, because that gap is what the letters are built on.

So the rule here is that we tell you where we stop, instead of selling you past it. When something is beyond what any tool of this kind can block — a tag a website builder loads before ours, a font pulled in by a style file, tracking that happens on a server where no browser can see it — we find it, we tell you, and we write it down. There's a page on this site that does nothing but list what we can't block. It's there on purpose.