How ConsentMark Works
A transparent, evidence-based methodology that scans your site, evaluates governance across five dimensions, and produces a letter grade from A to F. No black boxes.
Three-Stage Scan
Every scan follows the same reproducible process - discover what is on the page, test consent behaviour, then score against compliance gates.
Discover
ConsentMark loads your site in a real Chrome browser and catalogues every tag, script, cookie, and network request. No agents to install, no code changes required. The scan runs from an Irish vantage - an en-IE browser on Europe/Dublin time - as an automated visitor that identifies itself as one, and every result states the browser, region, viewport and capture window it ran from.
Consent
We test behaviour before and after consent. Which tags fire before consent is given? What happens when a visitor rejects tracking? Does your Consent Management Platform actually enforce consent signals?
Score
Every finding is evaluated against compliance gates ordered by severity. The first gate your site fails determines your grade ceiling. The result is a transparent letter grade from A to F, backed by evidence.
The five governance dimensions
Every scan is evaluated across these five dimensions. They are the same five the scoring engine names in your result, in the order they carry weight.
Technical Consent Controls
Whether a consent management platform is present, and whether the tags on the page honour an accept or a reject once it is given.
Cross-Border Data Transfers
Where the data goes. Which jurisdictions receive it, and whether those transfers rest on an adequacy decision or on something that needs safeguards.
Pre-Consent Data Leakage
What leaves the browser before the visitor has chosen. Cookies, storage writes, and identifiers sent ahead of consent are the clearest sign consent is not being enforced.
Governance Controls
Whether tags are deployed through a tag manager with version history and review, or hand-placed in the page where no one can see the change.
Third-Party Exposure
How many distinct third parties the page brings in. Each one is another processor to contract with, document, and answer for.
What the Grades Mean
Your grade is determined by a gate-based severity assessment. The first gate your site fails determines your grade ceiling - good behaviour elsewhere cannot offset a critical risk.
Strong governance
No tracking present, or consent is properly enforced with reject-all visible and respected.
Good with minor gaps
Tags use Consent Mode in restricted state, or minor engagement events fire pre-consent. Fundamentally sound.
Material gaps
Reject-all not visible, or data transfers to jurisdictions without adequate safeguards. Needs attention.
Incomplete implementation
CMP blocking technology is deployed but not fully enforced. The intent is there but the execution is not. A D can be flagged 'theatrical CMP' when the reject button produces no material reduction in tracker activity - tracker-count parity between accept and reject at or above 80% triggers this sub-grade.
Critical risk
No CMP, consent not enforced, PII leaking, or reject ignored. Immediate remediation required.
Insufficient data
Scanner could not collect sufficient data to verify compliance. Manual review recommended.
Why This Matters for Regulated Organisations
Analytics governance is no longer a technical detail. It is a board-level compliance obligation.
Regulatory Scrutiny
The Data Protection Commission and EU regulators are actively investigating tracking practices. A governance grade gives you evidence of your compliance posture before they ask for it.
GDPR Accountability
Article 5(2) requires you to demonstrate compliance, not just claim it. ConsentMark provides the structured evidence and audit trail that accountability demands.
Board-Level Risk
Unmanaged analytics tracking is a data protection risk that belongs on the risk register. A clear grade makes it visible, measurable, and actionable for leadership.
Transparent and Reproducible
Every governance grade includes the evidence that produced it. Your report shows which tags were detected, what consent signals were observed, where data is being sent, and how each dimension was scored. The methodology is versioned - when scoring criteria change, the version number is updated so scores remain comparable over time.