Sample report: example-store.test
This is a fabricated example, not a real scan of any real company. It's built from the same report layout and components a real Full Privacy Audit uses, so you can see exactly what $99 buys before you pay for one.
Sample report — example-store.test
Every number on this page is fabricated for a fictional demo site. This is what the full $99+ Full Privacy Audit produces, not a real scan of any real company.
Some sharing observed
Every site starts at 100 and loses points against a published rubric.
Scanned from United States (Oregon) · 43 of 43 pages, discovered from the sitemap · 4 consent states per page.
Executive summary
example-store.test shares visitor data with 6 identified third parties, 3 of which are contacted before the cookie banner is answered. Rejecting the banner does not stop most of them, and the Global Privacy Control browser signal is not honored. The single highest-impact fix is wiring the existing consent-management tool to actually block the three advertising tags until consent is given — that one change addresses the two largest findings below.
Top actions
- Gate the three advertising tags behind actual consent, not just banner visibility.
- Make Reject All stop every third party it currently misses, not only the banner itself.
- Honor the Sec-GPC: 1 signal the same way a Reject All click is honored.
5 findings
- Highobserved in the Before consent pass−15
5 third-party requests occurred before any consent interaction
connect.facebook.net · googleads.g.doubleclick.net · static.hotjar.com · cdn.segment.com · px.ads.linkedin.com — observed on the homepage and 2 category pages, before the visitor touched the cookie banner.
- Mediumobserved in the After Reject All pass−10
3 of the 5 pre-consent hosts were still contacted after Reject All
The consent-management widget hides its own banner on Reject All, but does not stop connect.facebook.net, googleads.g.doubleclick.net or px.ads.linkedin.com from loading on the next page view.
- Mediumobserved in the With Sec-GPC: 1 pass−8
No observable change when Sec-GPC: 1 was sent
The same 9 third-party hosts were contacted with and without the Global Privacy Control signal set on the request.
- Low−5
Session replay technology observed on the checkout page
hotjar.com records mouse movement, scrolling and form interaction on /cart and /checkout.
- Low−4
6 cookies set for longer than 12 months
_ga expires in 400 days (Chrome's own cap); _fbp in 90 days.
This sample lost 42 points in total, against the same published rubric every real audit uses.
Vendors observed × consent state
| Vendor | Category | Confidence | First seen |
|---|---|---|---|
| Google Ads / DoubleClick | Advertising | 98% | Before consent |
| Meta Pixel | Advertising | 97% | Before consent |
| LinkedIn Insight Tag | Advertising | 92% | Before consent |
| Hotjar | Session replay | 95% | After Accept All |
| Segment | Tag manager | 90% | Before consent |
| Stripe | Payments | 99% | After Accept All |
Cookies → vendor attribution
| Cookie | Domain | Party | Expires |
|---|---|---|---|
| _ga | example-store.test | First-party | 400d |
| _fbp | .facebook.com | Third-party | 90d |
| _gcl_au | example-store.test | First-party | 90d |
| hjSessionUser | .hotjar.com | Third-party | 365d |
Evidence
A real audit stores a screenshot of every page, in every consent state, served privately through a token-checked link — the same evidence a report's findings point back to. This sample has no real pages to screenshot, so this section is illustrative only.
Limitations
- Scanned from one region; a site that serves different banners by geography needs a region per audience.
- Covers pages discovered from the sitemap and site navigation, not pages behind a login.
- Reports what a scan observed technically — not a legal compliance determination.
A real audit also includes
- A downloadable PDF version of this report
- Screenshots of every page, in every consent state
- A per-page appendix, not just a site-wide summary
- Coverage across up to 500 pages, and multiple regions as an add-on
Sasquatch Privacy provides technical privacy observations and is not legal advice.