Waivern Consent Analyser
AI-Enhanced Compliance Report
Waivern.com shows significant GDPR and ePrivacy compliance violations including pre-consent tracking, continued processing after consent withdrawal, and inadequate consent mechanisms. The site initiates tracking requests and defines Google Analytics/GTM globals before user consent, violating the ePrivacy Directive's requirement for prior consent. Post-rejection tracking continues across multiple domains and subpages, breaching GDPR consent withdrawal requirements. The absence of a persistent consent withdrawal mechanism and misleading button language ('Accept only strictly necessary') constitute dark patterns prohibited under recent EDPB guidance.
🤖 = AI-assessed · 👁 = Vision (screenshot) · HIGH MEDIUM LOW = risk level from legal analysis
1 tracking domain(s) made requests before any consent signal was recorded.
No advertising cookies found in Storage before consent.
Tracker globals defined before consent: ['gtag', 'google_tag_manager']
| global | type |
|---|---|
| gtag | function |
| google_tag_manager | __defined_object__ |
No tracking keys found in web storage pre-consent.
All tracking scripts in DOM appear to be CMP-blocked (type=text/plain) or absent.
0 tracking domains active after consent-all (baseline).
1 cookies in storage after Accept All (full metadata).
Globals defined after consent: ['gtag', 'dataLayer', 'google_tag_manager']
| global | type |
|---|---|
| gtag | function |
| dataLayer | __defined_object__ |
| google_tag_manager | __defined_object__ |
Accept and Reject both require 1 click(s). Symmetric.
1 tracking domain(s) continued firing after reject-all.
No tracker scripts observed post-reject.
2 tracking pixel/beacon call(s) post-reject.
| url | vendor | category | timestamp |
|---|---|---|---|
| https://region1.google-analytics.com/g/collect?v=2&tid=G-SNNESL7MGP>m=45je6461h1v9231223469za200zd9231223469&_p=177563 | Google Analytics | ANALYTICS | 2026-04-08T07:03:07 |
| https://region1.google-analytics.com/g/collect?v=2&tid=G-SNNESL7MGP>m=45je6461h1v9231223469za200zd9231223469&_p=177563 | Google Analytics | ANALYTICS | 2026-04-08T07:03:09 |
Tracking activity detected on 2 subpage(s) after reject.
| page | global | phase |
|---|---|---|
| https://www.waivern.com/ | gtag | subpage_1 |
| https://www.waivern.com/ | google_tag_manager | subpage_1 |
| https://www.waivern.com/pricing | gtag | subpage_2 |
| https://www.waivern.com/pricing | google_tag_manager | subpage_2 |
No advertising cookies seen in request headers post-reject. Verify Storage tab with Component 2 for full confirmation.
No advertising cookies visible in document.cookie post-reject.
No tracking identifiers found in localStorage/sessionStorage post-reject.
1 first-party cookies in Storage after Accept All.
Cookie policy fetched from https://www.waivern.com/cookie-policy. 14 declared cookies found.
AI analysis: 0 cookie(s) fail the strictly-necessary test and should be absent after reject-all. Summary: One cookie observed (CookieConsent) which appears to be a consent management cookie. While not explicitly declared in the cookie policy, this type of cookie is typically considered strictly necessary for legal compliance and remembering user consent preferences. The cookie policy appears to be generic/template content with fragmented declarations that don't properly list actual cookies used on the site.
No advertising cookies observed in Set-Cookie response headers.
Found 0 first-party subdomains. Run 'dig CNAME
All advertising cookies absent from Storage post-reject.
No non-essential Set-Cookie headers observed post-reject.
No obvious ITP bypass patterns in Set-Cookie headers.
No tracking identifiers found in first-party web storage post-reject.
Tracker globals still defined after reject-all: ['gtag', 'google_tag_manager']
| global | type |
|---|---|
| gtag | function |
| google_tag_manager | __defined_object__ |
See H.1 — same evidence applies.
| global | present |
|---|---|
| gtag | True |
| google_tag_manager | True |
dataLayer contains 1 tracking event(s): ['gtm.dom']
| event |
|---|
| gtm.dom |
| gtm.load |
| gtm.scrollDepth |
| cookie_consent_update |
All 0 tracker scripts correctly blocked in DOM post-reject.
See I.1 — same check.
Based on DOM script inventory; full Sources tab verification requires Chrome DevTools protocol introspection (beyond current scope).
Requires manual browser configuration check.
Requires manual browser configuration check.
No obvious ITP-bypass server-side cookies detected.
Reject All available at first screen at same level as Accept All.
Cannot assess default toggle states as no manage preferences interface is visible in the provided screenshots
Using 'Accept' language for the reject option is a dark pattern that could confuse users into thinking they are accepting something rather than rejecting non-essential cookies. Clear 'Reject' or 'Decline' language would be more transparent
No persistent consent widget found. Users cannot easily withdraw consent.
Site content accessible after declining consent.
Consent preference correctly persisted to second tab.
No advertising cookies found on simulated return visit.
No persistent cross-phase identifiers detected in POST bodies.
No TCF consent strings detected in query parameters.
No session ID bridging detected across consent states.
No persistent vendor userIds detected in post-reject requests.
CMP identified as: Cookiebot
| url | Pricing | Waivern Ltd |
| test date | 2026-04-08 |
| test time utc | 2026-04-08T07:02:01 |
| cmp detected | Cookiebot |
| total requests | 193 |
| phases detected | pre_consentpost_reject |
| phase strategy | {'accept': 'not_detected', 'reject': 'timestamp_hint'} |