To check your site’s GDPR cookie compliance, run a free scan at /check (no account), which shows which trackers fire before consent, how cookies are classified, and whether the banner uses dark patterns. Then confirm manually in the DevTools Network and Application tabs, verify the Google layer with the Consent Mode v2 checker, and fix in priority order. Below is the full self-audit, step by step.
Why self-audit before someone reports you
A banner that "appears" is not a compliant site. Under GDPR and Romanian Law 506/2004, non-essential cookies need consent before they fire — not after, not "as you browse". The difference isn't visible to the naked eye: it's in which network requests leave when the page loads.
The good news: you don't need an auditor to find out where you stand. In five minutes you can see exactly what your site collects without permission. The less good news: any visitor can file a complaint for free with ANSPDCP, and "nobody checks small sites" is a bad bet. Better to find the problem yourself, in DevTools, than in a letter from the regulator.
Step 1: run a free scan
The fastest starting point is a free scan at /check — no account, no card. Enter your site's address and you get a list of what actually happens on load. Focus on three things in the report:
- Trackers before consent. Any non-essential cookie or script that fires before the click is a problem. These are exactly the requests an attentive visitor would report.
- Cookie categories. The scan splits cookies by type (strictly necessary, preferences, statistics, marketing). Check whether anything marketing or analytics is mislabelled as "essential".
- Banner dark patterns. The scan flags manipulative patterns — missing reject button, imbalanced buttons, pre-ticked boxes — that make consent invalid even when a banner exists.
The scan gives you the map. The next steps confirm it by hand, so you're sure about what you're fixing.
Step 2: confirm manually in DevTools
Open the site in a private window (no old cookies), press F12 and work in two tabs. Don't touch the banner yet — you want to see what happens before any click.
| DevTools tab | What to look for | Red flag |
|---|---|---|
| Network | Requests to tracking domains on load (filter by google-analytics, facebook, doubleclick, hotjar). | Any such request appears before you click "Accept". |
| Application → Cookies | Cookies set immediately, before consent. | You see _ga, _fbp, _gcl_au or other marketing cookies without having accepted. |
| Application → Storage | Local/session storage used by tracking scripts. | Keys written by pixels or analytics before the choice. |
Then press Reject on the banner and reload. If the same requests and cookies still appear after rejecting, the banner isn't actually blocking — it's just decorating. This is the most common thing scans find.
Step 3: check the Google layer (Consent Mode v2)
If you use Google Analytics or Google Ads, there's an extra layer: since March 2024, Consent Mode v2 is required for Google advertising features in the EEA. Blocking cookies isn't enough on its own; Google must receive all four signals — ad_storage, analytics_storage, ad_user_data, ad_personalization — and see them updated correctly when the user chooses.
You check this layer with the free Consent Mode v2 checker: it tells you whether the signals are present and whether they start as "denied" before consent. For full context, the Consent Mode v2 in Romania guide explains what each signal means, and how to verify Consent Mode v2 walks you through the manual method step by step.
Step 4: fix in priority order
You have the list. Not everything is equally urgent — tackle it in risk order:
- Stop marketing trackers that fire before consent. The Meta Pixel, Google Ads, remarketing — these are the most visible sign of non-compliance and the easiest to report.
- Block analytics until consent or move it onto a correctly configured Consent Mode v2 setup.
- Fix the banner: add a reject button as visible as accept, remove pre-ticked boxes, drop the manipulative patterns.
- Align the cookie policy with what the site actually sets — not with a copied template.
Once fixed, run the scan again to confirm. If you want real blocking, all four Consent Mode v2 signals and dark-pattern detection from a single tool, FewCookies is built for exactly this — but whatever you choose, a decision based on what you see in the Network tab beats any guess. The real non-compliance risk, from complaints to fines up to €20M or 4% of turnover, is detailed in the article on GDPR cookie fines in Romania.
Frequently asked questions
Can I check GDPR compliance myself, without a consultant?
Yes. A free scan at /check plus a few minutes in the DevTools Network and Application tabs shows exactly which trackers fire before consent and which cookies are set. A consultant is useful for complex cases, but the basic self-audit takes you five minutes on your own.
What does it mean that a tracker "fires before consent"?
It means the script or cookie activates on page load, before the visitor clicks "Accept". Under GDPR and Law 506/2004, non-essential cookies need prior consent, so any marketing or statistics tracker that fires before the click is a compliance problem.
Is the free scan enough, or do I also need the manual check?
The scan gives you a fast, reliable map of the problems. The manual DevTools check confirms it and helps you be sure of what you're fixing, especially after changes. Ideally you use them together: scan, confirm in Network, fix, then rescan.
Want to see which cookies and trackers fire on your site before consent? The scan is free and needs no account. Check your site for free →