Five forensic tests on your website — pre-consent, post-accept, post-reject, GPC signal, and internal routes — documented with SHA-256 evidence hashing. Cookie compliance, consent dark patterns, privacy policy gaps, and multi-jurisdiction exposure. Your consent platform says you're compliant. We produce the proof.
Not a CMP vendor. Not a cookie scanner. An independent forensic auditor.
We audit OneTrust, Cookiebot, CookieYes, and every other consent platform. No CMP vendor will build this tool — because it exposes failures in their own product.
Every finding is backed by SHA-256 hashed screenshots, a timestamped action log, and reproducible browser evidence — the format regulators cite in enforcement actions.
The same website gets different grades under GDPR vs CCPA. We detect applicable jurisdictions automatically and score against each one — including GPC testing across 12 US states.
Select the jurisdiction where your company is based. Cairn automatically detects additional applicable jurisdictions from your privacy policy, domain, and legal documents.
Results in under 3 minutes. Five-pass scan: pre-consent state, accept path, reject path, GPC signal test, and internal page discovery.
16 automated checks across cookie compliance and privacy infrastructure.
Privacy Setup Checks
Privacy policy, terms of service, cookie policy, and accessibility statement — verified across common URL paths.
Whether required legal pages are linked from the footer of every page, not buried or missing.
"Do Not Sell or Share" link detection — required if you share visitor data with advertising platforms.
A persistent cookie preferences link so users can change their consent after the initial banner disappears.
Forms collecting email addresses checked for consent checkboxes, pre-checked dark patterns, and privacy links.
Analyzes your privacy policy against 13 required GDPR disclosure elements with sub-element analysis.
Automatic identification of all applicable jurisdictions from your domain, privacy policy, hreflang tags, and legal documents.
Determines your primary legal obligation from governing law clauses, corporate entity suffixes, and physical address patterns.
The free scan gives you your compliance grade and headline findings. Paid tiers go deeper.
Why re-scan quarterly? Websites change constantly — new analytics tags, CMP drift, privacy policy updates, new regulations. A quarterly re-scan catches regressions before a regulator does.
OneTrust, Cookiebot and CookieYes are Consent Management Platforms — they implement the consent banner. Cairn is an independent auditor — we test whether their implementation actually works. We open a fresh browser, click Reject All, and document every cookie that persists. No CMP vendor will build this tool because it exposes failures in their own product. Beyond consent testing, Cairn analyzes dark patterns with measured CSS evidence, checks your privacy policy against 13 GDPR-required disclosure elements, tests GPC signal compliance, and provides jurisdiction-specific scoring across 7 regulatory frameworks.
GDPR (EU), UK GDPR + PECR, CCPA/CPRA (US), LGPD (Brazil), DPDP Act (India), PIPEDA (Canada), and Quebec Law 25. Cairn automatically detects which jurisdictions apply based on your privacy policy content, domain signals, hreflang tags, and company location. GPC signal compliance is tested against the legal requirements of 12 US states.
Yes. The scan uses a standard headless browser — the same technology Google uses to index your site. It sends normal HTTP requests, clicks your consent banner, and observes the response. It does not modify your site, inject code, or access any authenticated areas.
Only you. Your report is delivered to the email address you provide and stored on our servers for 90 days, then automatically deleted. We do not publish, share, or sell scan results. Full details in our Privacy Policy.
You get an instant summary report with your compliance grade, cookie breakdown, reject-path test result, and privacy setup findings. If you want the full report — complete cookie inventory, visual evidence, dark pattern analysis, policy adequacy review, and phased remediation roadmap — you can schedule a free 15-minute review call.
The report includes SHA-256 hashed screenshots, a timestamped forensic action log, and per-cookie penalty transparency — the evidence format regulators reference in enforcement actions. It is designed to be shared with legal counsel or attached to a regulatory filing. However, it is a technical assessment, not legal advice.
The free scan gives you both compliance grades and headline findings. The $750 Diagnostic adds the complete technical evidence. The $2,000 plan adds a step-by-step remediation roadmap. The $3,000 plan adds a strategic consultation. All paid tiers are available as annual plans with quarterly re-scans at up to 27% off.