Audit this page before consent

A web agency in Lyon opened a client homepage on 15 March 2026 and the audit came back at EUR 15,000 of exposure: three of the four cookie violations French regulators sanction most often were live on the page, and nobody at the agency had noticed.

The four violations are not a guess. They are the ones the CNIL keeps writing decisions about: trackers set before the visitor clicks anything, no Reject-all button as visible as Accept on the first layer of the banner, no purpose named for each tracker, and a refusal or withdrawal that the site quietly ignores. Three of those four were present on this client. The tool does not vote on them; you look at the page, you type what you see, and the arithmetic is fixed.

The numbers on that Lyon site: seven third-party trackers fired before any click. The longest cookie ran 24 months, which is 11 months past the 13-month cap the CNIL sets for cookie lifetime. The stored consent for returning visitors had last been asked 19 months earlier, which is 395 days past the six-month window in which consent stays valid. Refusal did work, so that fourth violation was not counted. Three violations out of four, against the EUR 20,000 cap the CNIL applies through its simplified procedure, comes to EUR 15,000.

That cap is where the cost stops being theoretical. Since January 2026 the CNIL has issued 23 cookie sanctions through the simplified procedure, averaging EUR 5,815 each. It is not a headline-grabbing number, which is exactly why it keeps happening: it is cheap enough to issue and expensive enough to ruin a retainer.

Change the country and the arithmetic changes with it, which is the part a chatbot gets wrong. Move the same client to Spain and the ceiling is not EUR 20,000 but EUR 150,000, the cap the LSSI sets per infringement. A Spanish shop with twelve trackers before consent, no Reject-all on the first layer, purposes properly listed but withdrawal ignored, cookies inside the 13-month cap and consent asked four months ago scores the same three violations, and the exposure comes out at EUR 112,500 with 61 days still left in the consent window. Move to Italy and the reference point is higher again: the Garante fined Ediscom EUR 300,000 in February 2023, the first EU decision to treat dark patterns in a cookie banner as a violation in its own right. An Italian publisher with three trackers before consent, a Reject-all present, no purposes listed, withdrawal working, an 18-month cookie and consent last asked seven months ago lands on two violations, five months of cookie overrun, 30 days past the consent window, and EUR 150,000 of exposure.

Same page, same four questions, three different answers. A chatbot cannot open your client site, so it cannot see which trackers fire before the click, and when you ask it for the ceiling it hands you a confident number that belongs to a different country.

The free extension does the whole job: every check and every euro figure, for all three countries, with no key, no usage limit and no watermark.

What the paid layer adds sits on a different axis: keeping the result and repeating it. A dated .csv row per client site that you export and hand over as evidence, and a browser reminder 90 days after the audit date you typed. The Lyon audit was dated 15 March 2026, so the reminder falls on 13 June 2026 - before the client's next campaign rebuilds the tag manager and puts the trackers back.

For scale: a privacy consultant's per-site assessment for a small business runs about EUR 688 to EUR 2,236. Sources checked 21 September 2026.