Polaris Audit

EU regulators have issued 2,000+ GDPR fines

Your site is leaking data before consent.

Most tracking tags fire the moment a page loads — before anyone clicks your consent banner. Under GDPR, that’s a violation regulators are actively fining. Scan free in 10 seconds. Get the full report free.

100% free · No signup · Full PDF report included · 964 sites scanned

Try: ,

shop.exampleSample result

Compliance Leak

4 trackers fired before the consent banner was ready.

0 ms · page load1,180 ms · banner ready
0112GTM container loaded [googletagmanager.com]
0284GA4 page_view [google-analytics.com]Pre-consent
0391Meta Pixel PageView [facebook.com]Pre-consent
0517Cookie written: _fbp [.shop.example]Pre-consent
0640TikTok Pixel loaded [analytics.tiktok.com]Pre-consent
1180Consent banner ready
Full report: GTM fix steps per trackerPDF · free

The Zero‑Load Gap.

Regulators care whether tags fired before the click. The banner design is irrelevant.

01.

Unblocked Tags

High Risk

A marketer adds a TikTok Pixel or LinkedIn tag without a consent check. It fires for every visitor from day one.

02.

Race Condition

Silent Failure

Your banner is configured correctly — but GTM fires 200ms before the CMP initialises. The tag wins the race. You lose the case.

03.

Pre-Consent Cookies

Critical

Ad networks write tracking cookies on script load — before any click. Every cookie set before consent is an independent violation.

EU data protection authorities have issued over 2,000 GDPR fines to date. View Enforcement Tracker

Methodology

They provide the banner.
We provide the truth.

Most compliance scanners perform a static HTML crawl, looking for declared scripts. Polaris spins up a headless browser and intercepts every data packet transmitted before user interaction. View full methodology →

FeatureGeneric ScannersPolaris Audit
Engine
Static Crawler (HTML Regex)
Headless Browser (Playwright)
Detection
Declared Script Tags
Real-time Network Interception
Behavioral Audit
No (Static only)
Yes (Identifies Race Conditions)
Cookie Verification
Manifest-based
Actual Runtime Write-checks
Fix Guidance
Generic Legal Advice
Technical GTM Remediation

For Agencies

Your clients are probably leaking.
Now you can prove it.

Scan any URL in 10 seconds. If leaks are found, export a PDF with exact GTM fixes — your branding, ready to send.

Scan any URL

No install. No browser extension. Paste a URL, get results.

Branded PDF report

Client-ready output with per-tracker remediation steps included.

Monitoring (coming)

Scheduled re-scans and monthly client reports. Join the waitlist from any report.

Talk to us about agency monitoring →
Sample Polaris audit report for a fictional site, showing critical status, an executive summary, and step-by-step GTM fixes for GA4, Meta Pixel and TikTok Pixel.
Sample report · fictional site

Pricing · Open beta

Scan free. Report free. Really.

No paywall while we’re in open beta. No signup, no card. Every scan includes the full forensic PDF.

  • Timeline of every tracker firing before consent
  • Per-tracker GTM remediation steps
  • Cookie inventory with legal classification
  • GDPR Article citations per finding
Run a free scan →

Questions

What is a pre-consent tracker?

A tracking script or cookie that loads before the visitor interacts with the consent banner. Under GDPR and the ePrivacy Directive, non-essential trackers must not load until the visitor opts in. This is often called the zero-load requirement.

Is Polaris Audit free?

Yes. During the open beta, every scan and the full PDF audit report are free. No signup and no card required.

How does the scan work?

Polaris loads your page in a headless Chromium browser as a brand-new visitor, without clicking the consent banner. It records every network request and cookie set during page load, timestamps them, and matches them against a registry of known ad and analytics endpoints.

Which trackers does Polaris detect?

Google Analytics 4, Google Tag Manager, Google Ads / DoubleClick, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Microsoft Clarity, Bing UET, Hotjar, Pinterest, Snapchat, Reddit, X (Twitter) ads and more, plus tracking cookies such as _ga, _fbp, _ttp and _gcl_au.

Does Google Tag Manager loading count as a violation?

Not by itself. The GTM container is a loader. The problem is the tags inside it: every tracking tag needs a consent-based trigger. The Polaris report lists GTM remediation steps for each tracker found firing before consent.

Can agencies use Polaris on client sites?

Yes. Scan any client site you are authorised to audit and export the report as a PDF to send to the client. Scheduled monitoring with monthly client reports is in development; you can join the waitlist from any report.

Is this legal advice?

No. Polaris is a technical audit tool, in the same category as Lighthouse. It shows what fired and when, and how to fix it. For a formal compliance assessment, consult a qualified lawyer or DPO.