Website Monitoring: Verify What Your Sites Actually Send

Website privacy monitoring tests what your live websites actually do with visitor data: which tags, pixels, scripts and cookies load, what they send, to which companies, and whether that matches the visitor’s consent choices and the law. Unlike a one-time audit or a CMP cookie scan, it runs continuously and covers the pages and journeys where violations tend to hide.

Most privacy laws apply to websites directly. In the US that includes CCPA/CPRA and the other comprehensive state laws, CIPA and other wiretap laws used in pixel and session-replay lawsuits, VPPA for pages that play video, HIPAA for health providers and Washington’s My Health My Data Act. Outside the US, GDPR, the ePrivacy Directive, UK GDPR and PECR, and Quebec Law 25 all require consent before non-essential tracking.

A typical enterprise site loads dozens of third-party tags, and those tags load others. Marketing teams add and change them constantly, often outside the CMP. Plaintiffs’ firms run automated scans to find pixels that fire before consent or capture search terms and form fields, which is why CIPA and VPPA lawsuits now number in the thousands.

Vault JS loads your pages from the outside in a real browser, from each region you choose and under each consent state, and follows real journeys through search, forms, checkout and logged-in areas. It captures every request, cookie and script, identifies the vendor behind each one, and checks the results against rule sets mapped to the laws that apply to you.

Yes. Vault JS can sign in with test accounts and walk through account pages, checkout, patient portals and other authenticated journeys, where some of the highest-risk data flows happen.

Identifiers, cookies, email and phone hashes, search terms, page URLs and titles, form field contents, video titles, location and health or financial signals, along with the vendor that received each one and the consent state at the time.

Continuously. Websites change every time a tag is added, a vendor updates its script or a campaign launches, so a quarterly audit misses most of what happens. Vault JS runs on a schedule you set, and your Customer Success Manager helps tune frequency and coverage to where the risk is.

Regulator fines, class-action lawsuits and settlements. California’s Attorney General and privacy agency have fined companies including Sephora, Honda, Todd Snyder and Healthline over website tracking and broken opt-outs, and private CIPA and VPPA suits can carry statutory damages per visitor.

CMP scans list the cookies they find on a sample of pages; tag QA tools check that analytics fire correctly. Vault JS is built for privacy and legal exposure: it tests every consent state across regions and journeys, shows what each vendor actually received, and ties findings to the laws that apply, using research libraries on vendors, cookies and case law.

Yes. A CMP collects and stores consent choices, but it can’t verify that every tag on the page honors them. Vault JS checks what actually happens after a visitor accepts, rejects or sends a GPC signal, and finds the tags the CMP doesn’t know about. In our own scans of sites using a leading CMP, about one in three vendors firing was missing from the CMP’s inventory.