Your result
The result lists the trackers seen in the HTML (Google Analytics, Meta, Hotjar, YouTube…), says whether they wait for consent, names the consent tool and checks the mandatory links.
Would you rather I looked myself, free of charge, within 24 hours?
Get my free opinionNo legal notice on your website yet? The generator writes the legal notice and the privacy policy of a website run in France from your answers, for your status (sole trader, company, association, regulated profession), with your hosting provider’s address already filled in.
Generate my legal notice: free, no e-mailA cookie banner proves nothing: what counts is what the page loads before the visitor has chosen. A website can show a nice banner while Google Analytics, the Facebook pixel or a YouTube video have already gone out. This tool reads the HTML of your home page, like a robot, without running the JavaScript: it spots the known trackers and says whether they wait for consent, recognises the consent tool (Axeptio, tarteaucitron, Cookiebot, Didomi…) and looks for the three mandatory links. For each point: what it saw, what it means, what to do. Built for French businesses and the French rules (CNIL), it works with any public website.
Tool built by Léo Guillaume, freelance developer near Rennes (France). I build, redesign and bring into line showcase websites for small and medium businesses, remotely, and I reply within 24 hours.
Updated on
What the test reads
The test reads the HTML like a robot, without running the JavaScript. That is its limit: a tracker added afterwards by a script or by Google Tag Manager cannot be seen from here. What it sees, it says plainly.
Google Analytics, Google Tag Manager, Google Ads, Meta pixel, Hotjar, Microsoft Clarity, LinkedIn, TikTok, Pinterest, Matomo, YouTube videos, Google Maps maps, reCAPTCHA: for each one, the test says whether it leaves as soon as the page opens.
A script switched off until the choice (type “text/plain” with a category, consent tool setting) or Google’s consent mode set to “denied”: those ones wait for the visitor.
Axeptio, Didomi, tarteaucitron, Cookiebot, CookieYes, Complianz, OneTrust, Iubenda, Usercentrics, Sirdata, AppConsent and a dozen others, recognised by their code.
A link to the page that says who publishes the website, its address, its registration and its host.
A link to the page that says which data the website collects, why, for how long, and how to exercise one’s rights.
A link or a button to change one’s choice, when the website places trackers subject to consent.
What the texts say
Nine rules, read on 8 November 2026 on Légifrance, the CNIL’s website and service-public.fr, the official French sources. Each one links to the text.
Article 82, French Data Protection Act
Reading or placing information on a visitor’s device requires their consent, after informing them of the purpose and of the means to object. Only the operations that serve solely the communication, or that are strictly necessary to the service they asked for, escape this rule.
Source: LégifranceCNIL guidelines, 17 September 2020
Going on browsing, using the app or scrolling the page is not consent. Refusing must be possible without any step, or with an action as simple as accepting, and withdrawing consent as simple as giving it.
Source: CNIL (Légifrance)CNIL guidelines, article 3
A website that lets third parties (Google, Meta, an ad network) place trackers from its pages must make sure that a mechanism does collect its visitors’ consent.
Source: CNIL (Légifrance)CNIL recommendation, 17 September 2020
The CNIL recommends two buttons of the same level and format, keeping the visitor’s choice (consent as well as refusal) for six months, and letting them withdraw it at any time through a “Manage my cookies” link or an icon on every page.
Source: CNIL (Légifrance)Audience measurement, CNIL page of 4 July 2025
An audience measurement tool can do without consent if it only measures the audience for the website’s exclusive account and produces anonymous statistics, without cross-referencing or passing them on to third parties. The CNIL recommends trackers of 13 months at most and a retention of 25 months at most, and rules out the offers whose provider states it reuses the data for its own account.
Source: CNILCNIL questions and answers, 29 April 2026
A video or a share button that places trackers must place nothing before the visitor agrees; the click on the video can be used to ask. A CAPTCHA is exempt if it only secures the website, but the CNIL cites reCAPTCHA among the solutions whose provider states it reuses the data.
Source: CNILCNIL decision of 8 October 2026
Tools that record a visitor’s full journey to replay it, as Hotjar and Microsoft Clarity offer, are subject to their prior consent. The CNIL also recommends masking forms and blocking the collection of passwords and bank details. Published in the French Official Journal of 5 November 2026.
Source: CNIL (Légifrance)Sanctions published by the CNIL
On 4 November 2025, €4,000 for a consultancy serving underwater sports clubs; on 18 December 2025, €2,000 and an injunction for a travel agency: two simplified procedures over cookies, information and consent. On 1 September 2025, €325 million for an online services company.
Source: CNILChecked on 13 October 2026
A business website in France, sole traders included, must say who publishes it, its address, its registration and its host, or face a fine of €75,000 for a sole proprietorship and €375,000 for a company. The privacy policy must be reachable from every page through a clearly visible link.
Source: Service-public.frThis test does not replace an audit or legal advice: it says what the HTML of the home page shows, without running the JavaScript. For a website that sells online, stores customer accounts or advertises, a full check in the browser, page by page, remains necessary.
Your website is at risk
The same path for a showcase website, a WordPress site or an online shop, from the most urgent to the simplest.
Axeptio, tarteaucitron, Cookiebot, Didomi, or a WordPress plugin such as Complianz or CookieYes: the tool must block every tracker until the choice, and offer “Accept all” and “Reject all” at the same level.
The trap A banner that informs without blocking anything: the trackers leave before the click, and the banner is useless.
Statistics, advertising, videos, maps: every script goes under the tool’s control, including those added by the theme and the plugins (Site Kit, MonsterInsights, the reCAPTCHA of the contact form).
The trap Optimisers such as WP Rocket or LiteSpeed Cache delay scripts until the visitor’s first move: the page is faster, but nobody gave consent.
Either it waits for consent (blocked by the consent tool, or Google’s “basic” mode), or you switch to an audience measurement configured for the exemption, such as Matomo set up following the guide published on the CNIL’s website.
The trap Google’s “advanced” consent mode loads Google tags on arrival: according to Google, they send cookieless measurements before the choice.
An image with a “Play the video” button that asks for consent before loading the player; for the map, a screenshot with a link to Google Maps. Most consent tools can do it.
The trap Switching to youtube-nocookie.com: according to Google, the videos watched no longer personalise YouTube, but Google does not say that nothing is stored.
Legal notice, privacy policy and “Manage my cookies”, on every page. The policy says which data you collect, why, for how long, and how to exercise one’s rights.
The trap A single “Legal notice” page that hides the privacy policy without saying so in the link.
Remove the pixels of finished campaigns and forgotten trials, then open the website in a private window: before any click on the banner, the developer tools (F12, “Application” tab, “Cookies”) must show no measurement or advertising cookie.
The trap Testing in a browser where you already accepted: your old choice hides the problem.
Frequently asked questions
Not always. You need one as soon as the website places or reads trackers that require consent: advertising, social network buttons and videos, session recording, statistics that do not meet the exemption conditions. A website that only uses essential trackers (cart, login, language choice, memory of the cookie choice) or an exempt audience measurement does not need one; for audience measurement, the CNIL still recommends informing visitors, for example in the privacy policy.
Only if it meets every condition of the exemption: audience measurement for your account alone, anonymous statistics, no cross-referencing or passing on to third parties. The CNIL states that the offers whose provider says it reuses the data for its own account do not benefit from it, unless that reuse can be switched off. Until you have checked it in Google’s terms, the safest is to load Google Analytics after the visitor agrees, or to switch to a tool configured for the exemption.
Yes, if it is set up for it. The CNIL publishes on its website a configuration guide of Matomo Analytics for the exemption: data exports switched off, a way for visitors to refuse being tracked, anonymised IP addresses, no third-party cookies or cross-domain tracking, no User ID, heatmaps and session recordings switched off, no personal data collected. The test sees Matomo, not its settings: it therefore rates it “to check”.
The CNIL publishes its sanctions. The best known target large groups (€325 million on 1 September 2025 for an online services company, €150 million the same day for a clothing retailer), but it also fines small organisations through a simplified procedure: €4,000 on 4 November 2025 for a consultancy serving underwater sports clubs, €2,000 and an injunction on 18 December 2025 for a travel agency, €15,000 and an injunction on 26 March 2026 for a ticketing company (with other breaches).
Yes, in France. A business website, sole traders included, must show its identity, its address, its registration and its host: up to €75,000 fine for a sole proprietorship and €375,000 for a company. As soon as it collects data, it must also say which data, why, for how long and how to exercise one’s rights, in a privacy policy reachable from every page through a clearly visible link.
Not necessarily. The plugin (Complianz, CookieYes, Cookiebot, tarteaucitron…) must block the scripts until the choice, including those placed by the theme or other plugins: Site Kit or MonsterInsights for Google Analytics, the reCAPTCHA of a contact form, a YouTube video in a page builder. Optimisers such as WP Rocket or LiteSpeed Cache delay some scripts until the visitor’s first move, which is not consent. The test shows what leaves before the choice.
Yes, if it loads with the page. The CNIL asks that embedded content place no tracker subject to consent before the visitor agrees; the click on the video can be used to ask for that consent. YouTube’s privacy-enhanced mode (youtube-nocookie.com) prevents, according to Google, the videos watched from personalising YouTube and the ads, but Google does not say that nothing is stored: the test rates it “to check”.
The rule is that refusing must be as easy as accepting. To get there, the CNIL recommends a “Reject all” button at the same level and with the same look as “Accept all”. Going on browsing or scrolling the page is never consent. On 31 December 2021, the CNIL fined two large platforms (€150 million and €60 million) over the way they let users refuse cookies.
It reads the HTML of the home page once, like a robot, without running the JavaScript. It recognises the most common trackers (Google Analytics, Google Tag Manager, Google Ads, Meta pixel, Hotjar, Microsoft Clarity, LinkedIn, TikTok, Pinterest, Matomo, YouTube, Google Maps, reCAPTCHA), the most widespread consent tools, and looks for three links: legal notice, privacy, cookie settings. It cannot see what Google Tag Manager or a script loads afterwards, nor the other pages of the website, nor the content of your legal pages. It does not replace an audit or legal advice.
Yes, for statistics only: the address of the website tested, the verdict, the trackers recognised and the consent tool found are kept for twelve months, to measure for example the share of websites that load Google Analytics without consent. They are never used to prospect and never published website by website. The address is not sent to PostHog, this website’s analytics tool. Your e-mail is only asked if you want to receive the result; it is only kept if you agree to be contacted.
Send me the address. I reply within 24 hours with what I see: the trackers to block, the consent tool to install or set up, the legal pages to complete, and a firm price if you want me to handle it.