Enforcement self-test
Agreely provides an automated enforcement scan that verifies your zero-click configuration works as intended. This scan is a point-in-time verification: it proves enforcement was working at the time of the scan. It is not a permanent real-time runtime guarantee.
The zero-click scan
The enforcement scan (mode: verification) opens your site in a headless browser
(Chromium via Playwright), clicks nothing, and verifies:
- That only strictly-necessary cookies are present before any interaction.
- That the Consent Mode v2 signal is in default-deny mode before GTM loads.
- That the Agreely snippet with your site key is present.
- That no tracking script fired without consent.
A report lists any violations by name (for example:
_ga emitted before analytics category was granted).
An honest count, by kind
The report never mixes kinds. It separates cookies, storage keys (local/session storage) and plain tracker hosts contacted that deposit nothing. The wording reflects exactly what was found, for example:
- "1 non-essential cookie detected before consent"
- "3 non-essential storage keys detected before consent"
- for a mixed case: "N cookies and M storage keys, non-essential, detected before consent"
A storage key is never presented as a deposited cookie, and a contacted host that deposits nothing is not counted as a violation. When there is no drift, the report reads "No non-essential cookies before consent".
Running a scan manually
In the Agreely dashboard, navigate to Cookie banner > your site > Installation and click Verify the installation (the same button confirms the tag is present and runs the zero-click scan). The result lives under Zero-click check. The scan typically completes in under a minute.
Staging origins
To test on your development or staging environment before deploying to production, add your origins in the website settings:
https://staging.yourdomain.com
http://localhost:3000
These additional origins (extra_origins) are accepted by the consent endpoint
and by the enforcement scan. The site key is the same; only the allowed origins
are extended.
Important. Staging origins are never exposed in the public banner configuration. They appear only in internal consent request validation and in scans.
Monthly drift check and alert
Agreely schedules a monthly drift scan for each verified website. If the scan detects a discrepancy from the last compliant state (for example, a new script that fires before consent), an email alert is sent to the account owner. One alert is sent per failure, so a still-failing site is not re-spammed.
The alert includes:
- The website domain concerned.
- The offenders by name, each with its kind (cookie, storage key, or tracker host) and its source host.
- A link to the installation page with the fix guidance.
- Honest wording: the scan is verified at a point in time, never a runtime guarantee.
What verification does not guarantee
- It does not guarantee that every scenario on your site is covered (the scan explores a subset of pages).
- It does not guarantee that your own server-side cookies are handled correctly (see Server side).
- A successful scan is not a compliance certificate. Your organization remains responsible for Law 25 compliance across all its purposes and processing.
Agreely helps document and demonstrate your posture; it does not substitute for your privacy officer's assessment or legal advice.