--- title: "VigiaLabs — Continuous cookie audit: check your website every week" description: "Continuous cookie audit for your websites: CookieSentinel checks each site every five to seven days, alerts you when cookies are set without consent and keeps signed evidence." url: https://www.vigialabs.ai/en/continuous-cookie-audit/ language: en updated: 2026-11-02 alternates: en: https://www.vigialabs.ai/en/continuous-cookie-audit/index.md es: https://www.vigialabs.ai/es/auditoria-continua-de-cookies/index.md ca: https://www.vigialabs.ai/ca/auditoria-continua-de-galetes/index.md --- VIGIALABS COOKIESENTINEL # Your website complied with the cookie rules. Does it still? *CookieSentinel checks it every week and alerts you if it stops complying.* ## Animation: how VigiaLabs CookieSentinel spots that a website has stopped complying with the cookie rules, alerts you and records the evidence 1. **The starting point — Your website complies on the day you check it** It has a cookie banner, the reject option is easy to see and the last check was clean. The trouble is that a website never stands still. 2. **The change — Every week, someone edits the website** The agency adds a campaign tag, a plugin is updated and a new page goes live. Nobody looks at the cookie banner again. 3. **The silent failure — Cookies are set without consent again** A new visitor arrives. Before they choose, the tag sets advertising cookies, tells Google about consent nobody has given, and your cookie policy does not mention them. From the inside, nothing looks different. 4. **The risk — Anyone can check it before you do** A user, an activist or a competitor can see it in their own browser and complain to the ICO. Fines under PECR can reach £17.5 million or 4% of worldwide turnover, whichever is higher, and Google can suspend your audiences and conversion measurement. 5. **The monitoring — CookieSentinel checks your website every week** It opens each site every five to seven days, on different days and at different times, and each check is made of three clean visits: accept and withdraw, reject, and customise. 6. **The alert — You are told as soon as it is found** You get an email saying what has changed: which cookie appears, which tag sets it, on which page and in which check. Your team knows what to fix without having to search. 7. **The evidence — What your policy says against what your website does** The report compares the cookies you declare with the ones that are actually set, and keeps every visit in a signed case file: screenshots, video, network log and timeline. 8. **The fix — The next check confirms the fix** Your team removes or reconfigures the tag and the next check verifies it. The history shows when the failure was found and when it was fixed. This is technical evidence, not a certificate of compliance. *Complying once is not enough: you have to keep complying.* **Description of each scene** 1. **Your website complies on the day you check it.** A company’s page, “www.example.com”, loads and its cookie banner appears with two buttons of the same size, “Accept” and “Reject”. In the browser bar a green label lights up: “Compliant”. On the right, the card “Last check · day 1” ticks four points in green: “Reject clearly shown”, “0 cookies before choosing”, “Rejection respected” and “Policy up to date”, followed by “No issues found”. 2. **Every week, someone edits the website.** A block of code named “campaign.js” drops into the page header, in red. On the right, the card “Changes to the website” adds three entries: “Day 13 · Tag Manager tag”, “Day 15 · Plugin updated” and “Day 17 · Page /offers/”. Below it appears “Nobody rechecks the banner”. 3. **Cookies are set without consent again.** The page loads again with the banner open and nothing clicked. The label in the browser bar turns from “Compliant” to “Breach”, in red. On the right, the panel “Cookies before choosing” shows three cookies in red: “_ads_id” and “_camp_ref”, for advertising, and “rec_session”, for session recording. Below, two red notices: “Signal sent to Google: ad_storage: granted” and “Cookie policy: not listed”. 4. **Anyone can check it before you do.** Three cards with a red stripe: “Fines up to £17.5m or 4%”, with the reference “PECR and DPA 2018, s. 157”; “Consent before storage”, with “PECR, regulation 6”; and “No audiences or conversions”, with “Google EU user consent policy”. Below, under the heading “Anyone can check it”, three cards, “A user”, “An activist” and “A competitor”, with lines running down to the red box “Complaint to the ICO”. 5. **CookieSentinel checks your website every week.** The page loads once more and the VigiaLabs lighthouse casts its beam over it. On the right, the four-week calendar “Automatic checks” marks five checks, on days 1, 7, 12, 19 and 25, each at a different height for its time of day. Below appear “Every 5 to 7 days, at varied hours” and three visits: “Accept and withdraw”, “Reject” and “Customise”. 6. **You are told as soon as it is found.** A scan line sweeps the page and a red outline circles the “campaign.js” block. On the right, an email from “CookieSentinel”, sent “Day 19 · 16:12”, opens with the subject “Your website has stopped complying” and four rows: “Cookie: _ads_id”, “Set by: campaign.js”, “Page: /offers/” and “Since: check on day 19”. At the bottom, the button “View the report”. 7. **What your policy says against what your website does.** Corner marks frame the page and a flash shows the capture. On the right, the card “Policy versus reality” shows three figures: 4 “Declared”, 7 “Observed” and, in red, 3 “Undeclared”. Below, the folder “Case file” opens with four pieces of evidence, “Screenshot”, “Video”, “Network log” and “Timeline”, and “Signed manifest” is stamped. 8. **The next check confirms the fix.** The card “Check history” shows days 1, 7 and 12 in green and day 19 in red. On the page, the “campaign.js” block disappears, the label in the browser bar goes back to “Compliant” and a green outline surrounds the browser. Back in the history, day 25 turns green and “Check on day 25: compliant again” and “Failure and fix, on record” appear. IN SHORT ## A website that complied can stop complying without warning. Cookies change every time someone edits the website. CookieSentinel checks it for you every week and alerts you before anyone else notices. - **The starting point** — A website that complied with the cookie rules can stop complying without anyone noticing. - **The change** — All it takes is a new tag, an updated plugin or a new page. - **The silent failure** — Cookies are then set without consent and the policy no longer matches what the website does. - **The risk** — Anyone can check it and complain. Fines can reach £17.5 million or 4% of turnover. - **The monitoring** — CookieSentinel checks your websites every five to seven days, on different days and at different times. - **The alert** — If something stops complying, you get an email with the details and the signed evidence is kept. WHAT BREAKS IT ## What quietly breaks cookie compliance It is rarely bad faith: it is the everyday life of a live website. These are ordinary changes that can set cookies without consent again. - **A new tag** — The agency or the marketing team adds a campaign pixel in the tag manager. Unless it is set to require consent, it fires anyway. - **An update** — A plugin, the theme or the shop platform is updated and starts loading third-party scripts that were not there before. - **A change to the banner** — The CMP is replaced, its settings are edited or the banner is redesigned, and the reject option becomes harder to see or stops working. - **A new page or language** — A campaign landing page, a blog or a version in another language goes live without the same banner or with different settings. - **Consent Mode with no default** — If the website sets no default consent state, Google’s tags behave as if the visitor had accepted. - **A policy that falls behind** — The cookie policy still describes the cookies of months ago, not the ones the website sets today. HOW IT WORKS ## A continuous audit, from start to finish. You add your sites and CookieSentinel does the rest. Each site is a domain with all its subdomains. ### What each cycle checks - Cookies and local storage before choosing, on accepting, on rejecting and on withdrawing - Consent signals sent to Google and Microsoft - Browser fingerprinting techniques - Cookie banner and policy against what is observed ### Technical evidence, not a certificate Each finding describes what was observed on a specific visit and can be verified and repeated. Its legal assessment is a matter for the competent authority, a court or a professional. 1. **Add your sites** — Tell us which domains you want monitored. On top of the sites in your plan, every plan includes up to five verified sites of your own at no cost. 2. **A check every five to seven days** — Three clean visits per site (accept and withdraw, reject, and customise), on different days and at different times, so that nothing that only happens at night or at weekends is missed. 3. **Email alert** — If something stops complying, you get an alert with the cookie, the tag that sets it, the page and the check in which it appeared. 4. **Report and case file** — Every check produces a downloadable report that compares your policy with what was observed, with a signed case file that a third party can verify. *Illustrative case · VL / COOKIES* - **CookieSentinel**: Your website has stopped complying · _ads_id — Cookie · campaign.js — Set by - **Check history**: Check on day 19 — Breach · Check on day 25 — Compliant *The monitoring · The alert · The fix* Fines and platforms ## The cost of finding out too late In the UK, storing or reading information on a visitor’s device without consent, where no exception applies, breaches regulation 6 of PECR, which the ICO enforces. On top of that: Google requires consent before its tags fire for visitors in the EEA, the UK and Switzerland, and can suspend the audiences and conversion measurement of advertisers who do not cooperate to meet its policy. 1. Fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for breaches of regulation 6 since 5 February 2026. 2. Advertising cookies always need consent: no exception covers advertising purposes, ad measurement included. 3. Rejecting must be as easy as accepting, and the ICO shows a banner without “reject all” as poor practice. 4. You must be able to show that consent was given, and keep records of it. **What you gain**: Find the failure yourself first and fix it before a complaint arrives. WHO IT IS FOR ## For anyone responsible for one website or many CookieSentinel is built for businesses and professionals who cannot check their websites by hand every week. - **Small businesses and sole traders** — They run a website or an online shop, nobody is dedicated to checking cookies and a fine hits the bottom line. - **Agencies and developers** — They manage their clients’ websites, add tags every day and want to show that they do it properly. - **Compliance leads and DPOs** — They oversee several sites, brands or languages and need a record of what was checked and what was fixed. PLANS ## Included in VigiaLabs plans CookieSentinel uses the same plans as our other services: choose how many sites you need and try it free for 30 days first. ### VigiaLabs plans From Plan 5 to Plan 50 and Enterprise, paid monthly or annually. - Up to five more verified sites of your own, at no cost, on every plan - Up to 100 or 250 pages per site in each cycle, depending on the plan - Alerts, reports and downloadable case files [See plans and prices](https://www.vigialabs.ai/en/pricing/) ### Free plan For 30 days, no card required, with the capacity of Plan 10. - Ten sites plus five verified sites of your own - The same checks, alerts and reports - Once per customer Request the free trial ### Chrome extension Free, to check the cookies of any page from your browser. - Free download with basic features - Connects to your subscription to unlock more features - Coming soon to the Chrome Web Store GLOSSARY ## The terms and the sources, in plain view. Every case is documented with sources and context. Scope is agreed for each market; the references on this page are to the law of the United Kingdom. - **Tracking cookie**: A cookie used to measure or follow browsing, for example for advertising. - **Cookie banner**: A message that explains the cookies a website uses and asks for permission to use them. - **CMP**: Consent management platform: a tool that shows the cookie banner and stores the visitor’s choice. - **Tag**: A piece of third-party code, such as an analytics, advertising or chat tool, added to a website, which can set cookies. - **Tag manager**: A tool, such as Google Tag Manager, for adding or changing tags without editing the website’s code. - **Consent Mode**: Google’s system through which a website tells its tags whether the visitor has given consent. It does not replace the cookie banner. - **Cookie policy**: A page that explains which cookies a website uses, what for and for how long. - **Continuous audit**: A check that is repeated at regular intervals to catch changes, rather than carried out only once. - **Clean session**: A visit made with a browser that holds no cookies or data from earlier visits. - **Regulation 6 of PECR**: The UK rule that requires consent before storing or reading information on a device, unless one of the exceptions in Schedule A1 applies. - **ICO**: The UK regulator for data protection and cookies, which enforces PECR and publishes guidance on storage and access technologies. - **Signed manifest**: A list of the files of a test with their digital fingerprints and a signature, to show that they have not been altered. ### References - [Privacy and Electronic Communications Regulations 2003, regulation 6 (legislation.gov.uk)](https://www.legislation.gov.uk/uksi/2003/2426/regulation/6) - [Data Protection Act 2018, section 157: maximum amount of penalty (legislation.gov.uk)](https://www.legislation.gov.uk/ukpga/2018/12/section/157) - [ICO: Guidance on the use of storage and access technologies](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/) - [Google: Help with the EU user consent policy](https://www.google.com/about/company/user-consent-policy-help/) - [Google: Set up consent mode on websites](https://developers.google.com/tag-platform/security/guides/consent) - [ICO: How do we manage consent in practice?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-manage-consent-in-practice/) - [Privacy and Electronic Communications Regulations 2003, Schedule 1: enforcement (legislation.gov.uk)](https://www.legislation.gov.uk/uksi/2003/2426/schedule/1) FREQUENTLY ASKED QUESTIONS ## Questions about the continuous cookie audit What businesses and professionals usually ask before monitoring their own websites. ### I already have a cookie banner. Why do I need a continuous audit? Because the banner is only one part. Whether the website respects the visitor’s choice depends on every tag, plugin and page, and that changes every time someone edits the website. A one-off check shows how it was on that day; CookieSentinel repeats it every five to seven days and alerts you if something stops complying. ### What is the risk if my website sets cookies without consent? Under PECR, storing or reading information on a device without consent, where no exception applies, breaches regulation 6. Since 5 February 2026 the ICO can impose fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. Google can also suspend the audiences and conversion measurement of advertisers who do not cooperate to meet its consent policy. ### How often is each site checked? Every five to seven days, on different days and at different times, so that nothing that only happens at night or at weekends is missed. Each check is made of three clean visits: accept and then withdraw consent, reject, and customise. ### What do I receive when something goes wrong? An email with the cookie that has appeared, the tag or script that sets it, the page and the check in which it was found. The report compares your cookie policy with what was observed, and the signed case file keeps screenshots, video, network log and timeline. ### How much does CookieSentinel cost? It is included in VigiaLabs plans, from Plan 5 to Plan 50 and Enterprise, paid monthly or annually. Every plan adds up to five verified sites of your own at no cost, and the Free plan lets you try it for 30 days, with no card required. ### Does CookieSentinel guarantee that my website complies with the law? No. It describes what is observed on each visit, with evidence that a third party can verify, so that your team can fix what is needed. It is not a certificate: the legal assessment is a matter for the competent authority, a court or a professional. LET’S LOOK FURTHER ## A clearer view starts with a conversation. Tell us what you want to monitor. Together, we will define a scope that makes sense for your business. Name Work email Company What would you like to monitor? (optional) ABE International (VigiaLabs) will use your details to answer your enquiry and, for security and fraud prevention, will record the IP address you send it from. Cloudflare Turnstile protects this form against automated submissions. More information in our [privacy policy](https://www.vigialabs.ai/en/privacy-policy/). Prefer email? [contact@vigialabs.ai](mailto:contact@vigialabs.ai) A focused conversation about your goals, markets and priorities.