# Cookies and consent

> Anyone can see which trackers and consent tools a homepage loads before a visitor clicks. Flowpane records that evidence. It is not a legal assessment.

Every public homepage reveals, to anyone who fetches it, which tracking technologies it references and whether a consent tool is present. Regulators, journalists, researchers, clients and competitors can all make that observation without asking permission. Flowpane records the same outside view as bounded evidence and gives it 12 of the 100 points in the site score, as an observation-risk score rather than a compliance verdict.

## What it is for

Cookie and consent governance usually lives inside an organisation: a consent tool, a cookie policy and a spreadsheet of vendors. The public homepage is where those records meet reality, and it is the version outsiders judge.

The observation answers a narrow question: what can someone outside the organisation see on the homepage before they interact with it? That is the starting point for any review, internal or external.

> This is evidence, not a legal compliance assessment. Flowpane does not decide whether a law applies, whether consent is valid, or whether a particular cookie is necessary. Those conclusions need your organisation's own records, behavioural testing and qualified advice.

## How it goes stale

Tracking technology often changes faster than consent configuration.

- **Tags added outside the release process.** Teams add analytics, advertising pixels or heatmap scripts through a tag manager or a CMS field, and the consent tool's configuration is not updated to match.
- **Consent tools removed or broken.** A redesign, theme change or platform migration drops the consent tool's script while the trackers remain.
- **Footprint creep.** Each campaign adds one more script, and no one removes the old ones. The homepage ends up referencing technologies that nobody in the organisation can explain.
- **Pre-interaction loading.** A script is configured to wait for consent in one environment but fires immediately in another.

None of these produce an error. The page still loads, and the drift is visible only to someone who looks at what the page actually sends.

## What true looks like

There is no file to publish, so "true" here means that the observable homepage matches your records:

- Every tracking technology the homepage references is in your current inventory, with an owner and a purpose.
- A consent tool is present wherever the inventory says one is needed.
- Technologies that need consent do not set third-party cookies before the visitor makes a choice.
- The number of referenced technologies is one you can justify, not an accumulation.

## How Flowpane checks it

Flowpane fetches the public homepage and scans the static HTML for two sets of known signatures.

| Signal | What Flowpane looks for | What it cannot prove |
| --- | --- | --- |
| Tracker signatures | Known script and endpoint strings for analytics, advertising, tag management, heatmap and customer-data tools | That the script executed or stored anything |
| CMP signatures | Known strings from consent-management platforms | That a banner appeared or choices worked |

Where available, a pre-interaction browser snapshot adds runtime evidence: cookies present before any interaction, how many are third-party, and whether a consent interface is in the page. The snapshot never clicks accept, reject or any preference control. It records the state a first-time visitor meets, nothing more.

The findings then feed an observation-risk score:

- **Trackers with no recognised consent tool** in the source is a review finding. A consent tool may still be injected dynamically, so it is a trigger for review, not proof of absence.
- **A broad tracking footprint** of more than five known signatures is a review finding, because every referenced technology is something you must be able to account for.
- **Third-party cookies before interaction**, where a snapshot exists, is a review finding. Flowpane does not classify the cookies' purpose or necessity.
- **A recognised consent tool** and the list of detected trackers are recorded as information.

Review findings deduct in bounded, capped amounts. One rule is absolute: if the homepage returns too little HTML to analyse, the result is 0 with a "could not be assessed" finding, rather than a clean result that the evidence does not support.

Whether this artefact is required or recommended depends on what the site declares about itself, for example e-commerce, payments or user accounts. If a firewall challenge blocks the homepage, the result is Blocked, not a low score.

## What Flowpane does not do

There is no editor for this artefact. Unlike the text files Flowpane monitors, there is nothing to draft, patch or propose, and AI Assist is not involved. Fixes happen in your tag manager, CMS or consent tool, and the next public check records the result.

The observation does not test accept, reject, withdrawal or granular preferences, does not follow navigation beyond the homepage, and does not infer ads.txt seller authority from advertising scripts.

## Common failures

| Symptom | What it means | Effect |
| --- | --- | --- |
| Trackers, no consent tool signature | Tool removed, or injected dynamically | Review finding |
| More than five tracker signatures | Accumulated footprint | Review finding |
| Third-party cookies before interaction | Scripts not waiting for consent | Review finding |
| Almost empty homepage response | Nothing to observe | Score 0 |

## Related

- [ads.txt](/learn/ads-txt)
- [How Flowpane fetches](/learn/how-flowpane-fetches)
- [Scoring](/learn/scoring)
- [Client reporting](/use-cases/client-reporting)
- [Portfolio](/use-cases/portfolio)