For Danish site owners and agencies: Privaci opens your site in a real browser and reads the browser’s own cookie jar, so you get HTTP-only cookies, CNAME cloaking and fingerprinting with it. A JavaScript-based tool cannot.
Scanned once. No banner was shown and nothing was clicked.
Run 14 Mar 2026, 09:14 shop.example.dk clicks: 0
| Finding | Observed |
|---|---|
| _ga Google Analytics google-analytics.com | Fired before consent |
| _fbp Meta Pixel connect.facebook.net | Fired before consent |
| canvas-fp Fingerprinting Canvas + WebGL | Ran before consent |
| PHPSESSID Required session shop.eksempel.dk | Exempt |
Scan ID 2026-03-14-1 3 findings 1 exempt
Conclusion positive evidence
Everything in this run was observed before anyone was asked, because nobody was ever asked. That is positive evidence, not an inference from the absence of a banner.
A cookie banner can only block what it knows about. And a consent log is missing half the story when the scanner cannot see the whole page.
The server sets them with Set-Cookie and marks them HttpOnly, so JavaScript cannot read them.
That flag is the entire point, and it is also why a tool that reads cookies through JavaScript cannot see them. Cookiebot documents this as a limitation of their own scanner. Legally, a cookie you never registered cannot be part of the consent assessment you have to be able to document.
The tracker answers on your own subdomain, for example metrics.yourdomain.com, through a DNS record.
In the browser the traffic looks first-party. It is absent from the cookie policy. Without a DNS lookup it is invisible to visitors and to most scanners alike. The transparency duty under GDPR Articles 13 and 14 applies regardless of how the tracker is wrapped.
Canvas, WebGL and AudioContext can identify a visitor without setting a single cookie.
Article 5(3) of the ePrivacy Directive is about storing information on equipment, not about cookies. Fingerprinting therefore needs consent even though nothing appears in the cookie list.
Conclusion supervisory plan 2026
In its 2026 supervisory plan the Danish Data Protection Agency made the processing of cookies on websites an enforcement priority, and it looks specifically at whether visitors get a real chance to refuse. A banner that does not know what runs on the page cannot offer that chance, and a log missing the trackers you could not see is not documentation.
We open the page once, as a visitor who was never asked. Everything the scan sees is therefore observed before consent, not guessed from whether a banner happens to be present.
Not an HTTP request and not a crawler. A Chromium instance that runs JavaScript, fetches tags, scrolls in steps to trip lazy-loaders and lets the page behave the way it behaves for a visitor.
We read the browser’s own cookie jar, not document.cookie. That is the only way to capture HTTP-only cookies, and it also catches localStorage, sessionStorage and writes that were cleaned up again before anyone could look.
There is no state to stamp wrongly, because there is only one. Each finding carries the phase the single run had, and consent cannot retroactively make a tracker that has already run lawful.
There is no accept button and no post-consent run. The scan has exactly one state: a visitor who was never asked.
When the trackers fire, relative to a consent
A timeline of the first 800 milliseconds of a page load. Four markers show when two tracker requests, an exempt cookie and a fingerprinting signal were observed. The band spans the whole window, because no consent was given at any point in the run.
No consent was given in this run
Measured: the window is the first 800 ms after navigation. Each mark is an event the browser itself reported in that run. The scan settled after 1,500 ms.
An example. Cookie names and timings vary from site to site.
A JavaScript-based scanner reads document.cookie. We read the browser’s own cookie jar. In the same run the two lists can be set against each other: what the script could see, against what the browser actually held. The difference is the cookies that would never have made it into your declaration.
The order is the buyer’s, not the engineer’s. The top item is the one that keeps you out of trouble.
The snippet parks tracker scripts, iframes and pixels in the markup and releases them only once the visitor has agreed. Until then the request never leaves the browser. This is not a report afterwards.
Every page gets a verdict, and every consent action is logged with a timestamp, a visit ID and the categories chosen. We store neither IP address nor user agent, so the log is documentation without becoming another personal-data problem.
HTTP-only cookies, CNAME cloaking and fingerprinting each arrive as their own finding. The section above explains why a JavaScript scanner misses them; the point here is that they are in the result, each with its own legal basis.
All four signals (ad_storage, analytics_storage, ad_user_data and ad_personalization) are mapped from the categories the visitor actually chose. Not from a fixed assumption.
Colour, position, logo and copy. Accept and reject are locked to the same size and weight in code, so no configuration can end up as a dark pattern.
Invite colleagues or clients per site with read or edit access. Agencies can manage several sites without sharing one login.
This is the real snippet, not an imitation. Switch between Free and Pro to see what Pro adds.
The rows are written from the vendors’ own public material. Where we cannot document a claim about a competitor, the cell says “not stated” — we never write that someone else lacks something we cannot prove.
| Criterion | Privaci | Cookiebot | Cookie Information |
|---|---|---|---|
| HTTP-only cookies Cookies the server sets, which JavaScript cannot read | Yes | Their own documentation describes the limitation | Not stated |
| Browser fingerprinting Canvas, WebGL, AudioContext and OffscreenCanvas — a finding of its own, not a footnote | Yes | Not stated | Not stated |
| localStorage, sessionStorage and IndexedDB Read in the same run as the cookie jar, including keys that are cleared again | Yes | Not stated | Not stated |
| CNAME cloaking The DNS chain is followed for every third-party host, per page | Yes | Not stated | Not stated |
| Evidence of when a tag ran Every finding is stamped pre-consent, because the run never clicks accept | Yes | Not stated | Not stated |
| Blocking beyond scripts Refused before they leave the browser: fetch, XHR, beacons, storage and service workers | Yes | Not stated | Not stated |
| Blocked or ran A stopped tag is reported as stopped, with its own state | Yes | Not stated | Not stated |
| Trackers no blocking can reach Flagged with a concrete fix, such as a module import | Yes | Not stated | Not stated |
| Consent log No IP address, no user agent. Policy hash, language and version | Yes | Not stated | Not stated |
| Reject and Accept are the same size Locked in code, so a theme cannot build a dark pattern | Locked in code | Configurable | Not stated |
| Scanner and blocking on Free Included from the first scan, with no feature gate | Yes | Yes, on Free (1 domain, up to 50 subpages) | No free plan, 14-day trial only |
| Price for a 50-page site Published price lists, excluding VAT. Checked 2026-09-22 | from DKK 0/mo. | DKK 0/mo. on Free, otherwise from approx. DKK 52/mo. | From approx. DKK 146/mo. |
Cookiebot and Cookie Information are reproduced from their own publicly available material and price lists, checked 2026-09-22. Euro amounts are converted to kroner, and they should be confirmed in a concrete quote before you rely on them. All Privaci amounts exclude VAT.
There is one paid product: Pro. You pay for how many pages the site has, and every Pro band includes the same features. A 12-page site should not pay for a 5,000-page one.
Find the number in your CMS sitemap. A guess is fine — the band moves itself once we have scanned.
not to scale · excl. VAT
Included in every Pro band
Free ≤ 50 pages Category-level consent · 1 scan / month · Community support
Privaci · monthly scan
Free · up to 50 pages · without your own brand sample
Pro Starter ≤ 50 pages
30 DKK/mo. · excl. VAT
324 DKK/yr. · you save 36 DKK against monthly billing
The band moves itself
We move you up on the first scan over the boundary and down again after two scans under it. The move is prorated from the day the count crosses. You get an email 30 days before an increase, and there is no lock-in.
In production we count your sitemap ourselves, so you do not have to look it up.
Measured: a page is a URL we actually fetch and scan. Redirects count at the target, query parameters and duplicates count once, and subdomains count within the same site.
| Band | Pages | DKK/mo. | DKK/yr. | DKK per page |
|---|---|---|---|---|
| Pro Starter | ≤ 50 pages | 30 | 324 | 0.60 |
| Pro Business | 51–350 pages | 80 | 864 | 0.23 |
| Pro Scale | 351–500 pages | 180 | 1.944 | 0.36 |
| Pro Enterprise | 501+ pages | 275 | 2.970 | 0.28 |
All amounts are in Danish kroner, excluding VAT. Free has no time limit and needs no payment card.
Each line is a capability in service, with the bound we know about. We state the bound because a capability without its limitation is a claim rather than a fact.
This list is not a roadmap. Everything below is built and in use on privaci.io itself, and every line can be checked in the product.
Status as of September 2026
For most Danish websites, yes, and on detection we go further, because we find HTTP-only cookies, CNAME cloaking and fingerprinting. But if your site is ad-funded and needs IAB TCF 2.2, or you want an auto-generated cookie declaration, we cannot solve that today. We would rather say so than let you discover it.
Free up to 50 pages, with no time limit and no payment card. Above that there is one Pro subscription where the price follows page count: 30 DKK/mo. up to 50 pages, 80 DKK/mo. up to 350, 180 DKK/mo. up to 500 and 275 DKK/mo. beyond that. Every Pro band includes the same features. Pay yearly and you get 10% off. All amounts exclude VAT.
An ordinary scanner fetches the page HTML and looks for cookie names in the code. It misses cookies set by JavaScript or in an AJAX call, and it never sees HTTP-only cookies at all. We open the page in a Chromium browser, let it finish running and then read the browser’s own cookie jar: the same list you see in developer tools under Application.
Both. The snippet parks tracker tags before the browser fetches them and releases them only after consent. That is not an after-the-fact report. The rules come from the most recent scan of your site, backed by 148 tracker domains built into the snippet that work from day one.
We store neither IP address nor user agent. The consent log holds a pseudonymous visit ID, the timestamp and which categories were chosen. That is enough to document your position to a supervisory authority without the log itself becoming another register of identifiable people.
Under two minutes. You create a site, confirm ownership with a DNS record or a meta tag, and paste one script tag. You get a free preview scan before you have even confirmed ownership, so you can see the result before you decide.
Privaci is developed and operated by bon.do ApS, a Danish software house in Svendborg, company registration 43473425. The product is built for the Danish and Nordic market, and all operations and all data sit in the EU.
Yes. There is no lock-in, and you cancel in the customer portal yourself. The subscription runs to the end of the paid period and then falls back to Free. Your data and your log are not deleted.
Create an account and run a free preview scan. You get the list of findings and a verdict per page, and you do not need to confirm ownership or enter a card to get there.
Privaci is developed and operated by bon.do ApS, a Danish software house in Svendborg that builds software for regulated environments. We do not build generic SaaS products: every product solves a bounded problem for a bounded group of people, and this is one of them.