Consent Audit

Consent Audit proves, with data from real visitors, whether a Drupal site contacts a third party or sets a cookie before the visitor has decided on consent, or after the visitor refused. It is a diagnostic, not a blocker: blocking is your cookie consent manager's job, and this module tells you where that manager fails.

What it does

• A dependency-free observer, loaded in the page header before any tracker, records every third-party request and every new cookie set while the visitor is undecided or has refused.
• Findings are aggregated per host, cookie name, phase and injector, so the report reads "connect.facebook.net, injected by the meta_pixel/tracking library" rather than naming a host and leaving you to guess. A host alone is a riddle; a host with its origin is a fix.
• Every visitor feeds the report, so campaign landing pages, popups that fire after a delay or on the third page, and A/B variants are all covered. An audit that only sees what an auditor visits misses exactly the things that leak.
• A report at /admin/reports/consent-audit, filterable by kind, phase and attribution, and one line on the status report.

Why the consent manager alone is not enough

A consent manager blocks by rewriting the src attribute of every script tag it finds while the page is built. A tracker that creates its own tag at runtime through document.createElement('script') leaves nothing in the markup to rewrite, and neither does an inline snippet that calls fetch() straight away. Consent Audit measures what actually left the browser, which is the only thing a regulator and a visitor care about.

Consent managers supported

• Klaro, through the consent_audit_klaro submodule.
• EU Cookie Compliance, through consent_audit_eu_cookie_compliance.
• COOKiES Consent Management, through consent_audit_cookies.

Any other manager, including one that is not a Drupal module, registers itself from a theme or a custom module with Drupal.consentAudit.registerSource().

What this module stores

Nothing that identifies a visitor: no IP address, no user agent, no cookie values, no query strings and no full third-party URLs. The table holds host names, cookie names, the injecting asset, the page path of the first sighting, and counts. It grows with the variety of leaks, not with traffic.