Enforcement self-test

Agreely provides an automated enforcement scan that verifies your zero-click configuration works as intended. This scan is a point-in-time verification: it proves enforcement was working at the time of the scan. It is not a permanent real-time runtime guarantee.

#The zero-click scan

The enforcement scan (mode: verification) opens your site in a headless browser (Chromium via Playwright), clicks nothing, and verifies:

1. That only strictly-necessary cookies are present before any interaction.
2. That the Consent Mode v2 signal is in default-deny mode before GTM loads.
3. That the Agreely snippet with your site key is present.
4. That no tracking script fired without consent.

A report lists any violations by name (for example: _ga emitted before analytics category was granted).

#Running a scan manually

In the Agreely dashboard, navigate to Cookies > your site > Installation and click Verify enforcement. The scan typically completes in under a minute.

#Staging origins

To test on your development or staging environment before deploying to production, add your origins in the website settings:

https://staging.yourdomain.com
http://localhost:3000

These additional origins (extra_origins) are accepted by the consent endpoint and by the enforcement scan. The site key is the same; only the allowed origins are extended.

Important. Staging origins are never exposed in the public banner configuration. They appear only in internal consent request validation and in scans.

#Monthly drift check and alert

Agreely schedules a monthly drift scan for each verified website. If the scan detects a discrepancy from the last compliant state (for example, a new script that does not respect consent), you receive an email alert at your organization's privacy officer address.

The alert includes:

• The page or pages where the discrepancy was detected.
• The cookies or scripts concerned.
• The full scan report for investigation.

#What verification does not guarantee

• It does not guarantee that every scenario on your site is covered (the scan explores a subset of pages).
• It does not guarantee that your own server-side cookies are handled correctly (see Server side).
• A successful scan is not a compliance certificate. Your organization remains responsible for Law 25 compliance across all its purposes and processing.

Agreely helps document and demonstrate your posture; it does not substitute for your privacy officer's assessment or legal advice.