What does your site store before anyone agrees?
One URL, one load, nothing clicked. Every cookie already in the jar, classified by category, vendor and party.
Why a cookie before consent is the finding that matters.
Every enforcement action that has touched cookie banners turns on the same fact: something was stored before the visitor had a say.
A banner is not the same as blocking
Most consent tools show a notice and leave the site’s scripts running underneath it. Tags fire, cookies land, and the banner is still on screen. Blocking means intercepting the cookie write until a choice is made — which is a different piece of engineering from displaying a notice.
Only strictly necessary cookies are allowed first
Session and load-balancing cookies, security tokens, and the record of the consent choice itself. Everything else — analytics, advertising, personalisation — needs consent before it is stored, under the GDPR and under every opt-in regime across Asia-Pacific.
Analytics is where this usually goes wrong
It feels harmless, so it gets left out of the guard. It is also the category regulators have been most consistent about. A _ga cookie written before the visitor clicks is the single most common finding this tool returns.
Third parties are the hardest to defend
A cookie your own domain sets is at least yours to explain. An identifier written by an ad network before consent is a transfer to someone else, and it is the version of this that attracts the largest fines.
We check one page, as a stranger would
The tool loads the URL you give it in a clean browser, waits for the cookie jar to stop changing, and reports it. It does not follow links and it does not click your banner — clicking would answer a different question, which is what happens after consent rather than before it.
Blocking, not just banners.
Katla's guard stops non-essential cookies being written until consent is given, and the AI scan keeps the inventory current so nothing new slips through unclassified. Running Google tags too? Check Consent Mode as well.