Consent audit (Pro)

Checks

• Consent Mode v2 (privacy.consent.mode-v2): the default must set all four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization). A default that grants a signal to everyone with no region scoping is flagged as an advisory.
• TCF version (privacy.consent.tcf): a configured TCF policy version below 5 is flagged (TCF v2.3 is required since February 2026). Absence is never a finding.
• Ungated tags (privacy.consent.pre-consent): a known tracker script with no consent-gating marker, one finding per vendor.
• Dark patterns (privacy.consent.dark-patterns): unequal refuse path, cookie wall, pre-ticked optional boxes, pay-or-consent wording.
• Banner accessibility (privacy.consent.banner-a11y): dialog role and name, positive tabindex, mouse-only controls, unnamed buttons.
• GPC hint (privacy.us.gpc) and a 12-state US privacy appendix in the PDF.

Limits

Keyboard traps, real focus order, contrast and what actually fires before consent need a rendered scan, which is on the roadmap.