01
The starting point
A website that complied with the cookie rules can stop complying without anyone noticing.
VIGIALABS COOKIESENTINEL
Your website complied with the cookie rules. Does it still?
CookieSentinel checks it every week and alerts you if it stops complying.
01 / 08The starting point
Your website complies on the day you check it
It has a cookie banner, the reject option is easy to see and the last check was clean. The trouble is that a website never stands still.
02 / 08The change
Every week, someone edits the website
The agency adds a campaign tag, a plugin is updated and a new page goes live. Nobody looks at the cookie banner again.
03 / 08The silent failure
Cookies are set without consent again
A new visitor arrives. Before they choose, the tag sets advertising cookies, tells Google about consent nobody has given, and your cookie policy does not mention them. From the inside, nothing looks different.
04 / 08The risk
Anyone can check it before you do
A user, an activist or a competitor can see it in their own browser and complain to the ICO. Fines under PECR can reach £17.5 million or 4% of worldwide turnover, whichever is higher, and Google can suspend your audiences and conversion measurement.
05 / 08The monitoring
CookieSentinel checks your website every week
It opens each site every five to seven days, on different days and at different times, and each check is made of three clean visits: accept and withdraw, reject, and customise.
06 / 08The alert
You are told as soon as it is found
You get an email saying what has changed: which cookie appears, which tag sets it, on which page and in which check. Your team knows what to fix without having to search.
07 / 08The evidence
What your policy says against what your website does
The report compares the cookies you declare with the ones that are actually set, and keeps every visit in a signed case file: screenshots, video, network log and timeline.
08 / 08The fix
The next check confirms the fix
Your team removes or reconfigures the tag and the next check verifies it. The history shows when the failure was found and when it was fixed. This is technical evidence, not a certificate of compliance.
Complying once is not enough: you have to keep complying.
Description of each scene
- Your website complies on the day you check it. A company’s page, “www.example.com”, loads and its cookie banner appears with two buttons of the same size, “Accept” and “Reject”. In the browser bar a green label lights up: “Compliant”. On the right, the card “Last check · day 1” ticks four points in green: “Reject clearly shown”, “0 cookies before choosing”, “Rejection respected” and “Policy up to date”, followed by “No issues found”.
- Every week, someone edits the website. A block of code named “campaign.js” drops into the page header, in red. On the right, the card “Changes to the website” adds three entries: “Day 13 · Tag Manager tag”, “Day 15 · Plugin updated” and “Day 17 · Page /offers/”. Below it appears “Nobody rechecks the banner”.
- Cookies are set without consent again. The page loads again with the banner open and nothing clicked. The label in the browser bar turns from “Compliant” to “Breach”, in red. On the right, the panel “Cookies before choosing” shows three cookies in red: “_ads_id” and “_camp_ref”, for advertising, and “rec_session”, for session recording. Below, two red notices: “Signal sent to Google: ad_storage: granted” and “Cookie policy: not listed”.
- Anyone can check it before you do. Three cards with a red stripe: “Fines up to £17.5m or 4%”, with the reference “PECR and DPA 2018, s. 157”; “Consent before storage”, with “PECR, regulation 6”; and “No audiences or conversions”, with “Google EU user consent policy”. Below, under the heading “Anyone can check it”, three cards, “A user”, “An activist” and “A competitor”, with lines running down to the red box “Complaint to the ICO”.
- CookieSentinel checks your website every week. The page loads once more and the VigiaLabs lighthouse casts its beam over it. On the right, the four-week calendar “Automatic checks” marks five checks, on days 1, 7, 12, 19 and 25, each at a different height for its time of day. Below appear “Every 5 to 7 days, at varied hours” and three visits: “Accept and withdraw”, “Reject” and “Customise”.
- You are told as soon as it is found. A scan line sweeps the page and a red outline circles the “campaign.js” block. On the right, an email from “CookieSentinel”, sent “Day 19 · 16:12”, opens with the subject “Your website has stopped complying” and four rows: “Cookie: _ads_id”, “Set by: campaign.js”, “Page: /offers/” and “Since: check on day 19”. At the bottom, the button “View the report”.
- What your policy says against what your website does. Corner marks frame the page and a flash shows the capture. On the right, the card “Policy versus reality” shows three figures: 4 “Declared”, 7 “Observed” and, in red, 3 “Undeclared”. Below, the folder “Case file” opens with four pieces of evidence, “Screenshot”, “Video”, “Network log” and “Timeline”, and “Signed manifest” is stamped.
- The next check confirms the fix. The card “Check history” shows days 1, 7 and 12 in green and day 19 in red. On the page, the “campaign.js” block disappears, the label in the browser bar goes back to “Compliant” and a green outline surrounds the browser. Back in the history, day 25 turns green and “Check on day 25: compliant again” and “Failure and fix, on record” appear.
IN SHORT
A website that complied can stop complying without warning.
Cookies change every time someone edits the website. CookieSentinel checks it for you every week and alerts you before anyone else notices.
02
The change
All it takes is a new tag, an updated plugin or a new page.
03
The silent failure
Cookies are then set without consent and the policy no longer matches what the website does.
04
The risk
Anyone can check it and complain. Fines can reach £17.5 million or 4% of turnover.
05
The monitoring
CookieSentinel checks your websites every five to seven days, on different days and at different times.
06
The alert
If something stops complying, you get an email with the details and the signed evidence is kept.
WHAT BREAKS IT
What quietly breaks cookie compliance
It is rarely bad faith: it is the everyday life of a live website. These are ordinary changes that can set cookies without consent again.
01
A new tag
The agency or the marketing team adds a campaign pixel in the tag manager. Unless it is set to require consent, it fires anyway.
02
An update
A plugin, the theme or the shop platform is updated and starts loading third-party scripts that were not there before.
03
A change to the banner
The CMP is replaced, its settings are edited or the banner is redesigned, and the reject option becomes harder to see or stops working.
04
A new page or language
A campaign landing page, a blog or a version in another language goes live without the same banner or with different settings.
05
Consent Mode with no default
If the website sets no default consent state, Google’s tags behave as if the visitor had accepted.
06
A policy that falls behind
The cookie policy still describes the cookies of months ago, not the ones the website sets today.
HOW IT WORKS
A continuous audit, from start to finish.
You add your sites and CookieSentinel does the rest. Each site is a domain with all its subdomains.
What each cycle checks
- Cookies and local storage before choosing, on accepting, on rejecting and on withdrawing
- Consent signals sent to Google and Microsoft
- Browser fingerprinting techniques
- Cookie banner and policy against what is observed
Technical evidence, not a certificate
Each finding describes what was observed on a specific visit and can be verified and repeated. Its legal assessment is a matter for the competent authority, a court or a professional.
- 01
Add your sites
Tell us which domains you want monitored. On top of the sites in your plan, every plan includes up to five verified sites of your own at no cost.
- 02
A check every five to seven days
Three clean visits per site (accept and withdraw, reject, and customise), on different days and at different times, so that nothing that only happens at night or at weekends is missed.
- 03
Email alert
If something stops complying, you get an alert with the cookie, the tag that sets it, the page and the check in which it appeared.
- 04
Report and case file
Every check produces a downloadable report that compares your policy with what was observed, with a signed case file that a third party can verify.
Illustrative caseVL / COOKIES
CookieSentinelYour website has stopped complying_ads_idCookiecampaign.jsSet by
Check historyCheck on day 19BreachCheck on day 25Compliant
Fines and platforms
The cost of finding out too late
In the UK, storing or reading information on a visitor’s device without consent, where no exception applies, breaches regulation 6 of PECR, which the ICO enforces.
On top of thatGoogle requires consent before its tags fire for visitors in the EEA, the UK and Switzerland, and can suspend the audiences and conversion measurement of advertisers who do not cooperate to meet its policy.
- 01Fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for breaches of regulation 6 since 5 February 2026.
- 02Advertising cookies always need consent: no exception covers advertising purposes, ad measurement included.
- 03Rejecting must be as easy as accepting, and the ICO shows a banner without “reject all” as poor practice.
- 04You must be able to show that consent was given, and keep records of it.
What you gainFind the failure yourself first and fix it before a complaint arrives.
WHO IT IS FOR
For anyone responsible for one website or many
CookieSentinel is built for businesses and professionals who cannot check their websites by hand every week.
01
Small businesses and sole traders
They run a website or an online shop, nobody is dedicated to checking cookies and a fine hits the bottom line.
02
Agencies and developers
They manage their clients’ websites, add tags every day and want to show that they do it properly.
03
Compliance leads and DPOs
They oversee several sites, brands or languages and need a record of what was checked and what was fixed.
PLANS
Included in VigiaLabs plans
CookieSentinel uses the same plans as our other services: choose how many sites you need and try it free for 30 days first.
01
VigiaLabs plans
From Plan 5 to Plan 50 and Enterprise, paid monthly or annually.
- Up to five more verified sites of your own, at no cost, on every plan
- Up to 100 or 250 pages per site in each cycle, depending on the plan
- Alerts, reports and downloadable case files
02
Free plan
For 30 days, no card required, with the capacity of Plan 10.
- Ten sites plus five verified sites of your own
- The same checks, alerts and reports
- Once per customer
Coming soon
Chrome extension
Free, to check the cookies of any page from your browser.
- Free download with basic features
- Connects to your subscription to unlock more features
- Coming soon to the Chrome Web Store
GLOSSARY
The terms and the sources, in plain view.
Every case is documented with sources and context. Scope is agreed for each market; the references on this page are to the law of the United Kingdom.
- Tracking cookie
- A cookie used to measure or follow browsing, for example for advertising.
- Cookie banner
- A message that explains the cookies a website uses and asks for permission to use them.
- CMP
- Consent management platform: a tool that shows the cookie banner and stores the visitor’s choice.
- Tag
- A piece of third-party code, such as an analytics, advertising or chat tool, added to a website, which can set cookies.
- Tag manager
- A tool, such as Google Tag Manager, for adding or changing tags without editing the website’s code.
- Consent Mode
- Google’s system through which a website tells its tags whether the visitor has given consent. It does not replace the cookie banner.
- Cookie policy
- A page that explains which cookies a website uses, what for and for how long.
- Continuous audit
- A check that is repeated at regular intervals to catch changes, rather than carried out only once.
- Clean session
- A visit made with a browser that holds no cookies or data from earlier visits.
- Regulation 6 of PECR
- The UK rule that requires consent before storing or reading information on a device, unless one of the exceptions in Schedule A1 applies.
- ICO
- The UK regulator for data protection and cookies, which enforces PECR and publishes guidance on storage and access technologies.
- Signed manifest
- A list of the files of a test with their digital fingerprints and a signature, to show that they have not been altered.
References
- Privacy and Electronic Communications Regulations 2003, regulation 6 (legislation.gov.uk)
- Data Protection Act 2018, section 157: maximum amount of penalty (legislation.gov.uk)
- ICO: Guidance on the use of storage and access technologies
- Google: Help with the EU user consent policy
- Google: Set up consent mode on websites
- ICO: How do we manage consent in practice?
- Privacy and Electronic Communications Regulations 2003, Schedule 1: enforcement (legislation.gov.uk)
FREQUENTLY ASKED QUESTIONS
Questions about the continuous cookie audit
What businesses and professionals usually ask before monitoring their own websites.
I already have a cookie banner. Why do I need a continuous audit?
Because the banner is only one part. Whether the website respects the visitor’s choice depends on every tag, plugin and page, and that changes every time someone edits the website. A one-off check shows how it was on that day; CookieSentinel repeats it every five to seven days and alerts you if something stops complying.
What is the risk if my website sets cookies without consent?
Under PECR, storing or reading information on a device without consent, where no exception applies, breaches regulation 6. Since 5 February 2026 the ICO can impose fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. Google can also suspend the audiences and conversion measurement of advertisers who do not cooperate to meet its consent policy.
How often is each site checked?
Every five to seven days, on different days and at different times, so that nothing that only happens at night or at weekends is missed. Each check is made of three clean visits: accept and then withdraw consent, reject, and customise.
What do I receive when something goes wrong?
An email with the cookie that has appeared, the tag or script that sets it, the page and the check in which it was found. The report compares your cookie policy with what was observed, and the signed case file keeps screenshots, video, network log and timeline.
How much does CookieSentinel cost?
It is included in VigiaLabs plans, from Plan 5 to Plan 50 and Enterprise, paid monthly or annually. Every plan adds up to five verified sites of your own at no cost, and the Free plan lets you try it for 30 days, with no card required.
Does CookieSentinel guarantee that my website complies with the law?
No. It describes what is observed on each visit, with evidence that a third party can verify, so that your team can fix what is needed. It is not a certificate: the legal assessment is a matter for the competent authority, a court or a professional.
LET’S LOOK FURTHER
A clearer view starts
with a conversation.
Tell us what you want to monitor. Together, we will define a scope that makes sense for your business.
Prefer email? contact@vigialabs.ai
A focused conversation about your goals, markets and priorities.