About Consentinel
We built a crawler because our own scanner lied to us.
Consentinel started as a tool for our own sites. It became a product the day we realized every consent scanner was reading a list instead of the page.
§1 — The site
In 2024 we ran a handful of small-business sites — a SaaS landing page, a client's Wix store, a couple of WordPress blogs. We'd installed the standard consent plugin, toggled everything to require consent, and moved on. CIPA wasn't on our radar. Then a friend who's a lawyer sent us a demand letter she'd just drafted against a company that looked a lot like ours. Same platform. Same "compliant" banner. Same session recorder running underneath it.
A session recorder is the script that captures what a visitor types, where they move their mouse, how far they scroll — the exact behavior the plaintiffs' bar cites under CIPA's wiretapping sections. Our banner said Marketing and Functional were off. The recorder was still running.
§2 — The scan
We ran the scan our consent plugin shipped with. It came back clean. So did two of the leading competitors. They identified trackers by matching script URLs against a vendor catalog, and the recorder either wasn't flagged as risky or wasn't on the list at all. The tool was reading a list. It wasn't reading the page.
We opened DevTools and watched the recorder fire before the banner had been touched. The gap between what the scanner reported and what actually loaded was the whole problem.
"The plaintiff's expert wasn't matching URLs to a list — they were watching the page load. Our defense had to be built the same way."
§3 — The build
So we wrote a headless-browser crawler — the same thing that became the free scan. It loads a page like a real visitor, clears cache, declines the banner, and watches every request that fires. No catalog. No assumptions. Just what the page actually does.
On our own Wix site it found four Zoho tracking cookies, five session-recording beacons, and the recorder itself — all firing with consent off. That's when a side project became a product.
§4 — The principle
We could have shipped the catalog-based scanner everyone else ships and called it a day. We didn't, because the demand letter we'd seen was built on exactly that gap. We'd rather tell you the ceiling than sell you past it. When something is outside what any client-side tool can stop, we detect it, we tell you, and we document it.
What we believe
Three things we won't compromise on.
Crawl, don't catalog
We identify trackers by what they do, not whether they're on a vendor list. A tracker that isn't in any catalog still fires — and a crawler still sees it.
Tell the ceiling
Blocking is a property of where a platform lets a tool's script run. We tell you what we can't stop instead of pretending the gap isn't there.
Prove it
A dashboard that says 'blocked' isn't a defense. A tamper-evident report of what actually loaded before consent is.