Compliance Copilot

Compliance Copilot checks your site for compliance problems and links each one to its fix. It uses the same checks as the Compliance Report, the Consent Debugger and the public scanner, so all four always agree.

This is a Pro+ feature.

How to access

1. Open your site in the CookieBoss dashboard
2. Navigate to the Site Detail page
3. Find the Compliance Copilot card
4. Click Run Check to analyze your site

What it judges

Two things, and never your unpublished draft:

• What your site does before a visitor chooses. Your latest cookie scan loads the site as a first-time EU visitor and records the cookies, browser storage, tracking requests and fingerprinting that happen before any choice. Whether tracking runs before consent can only be seen this way, so without a recent scan the Copilot says so instead of guessing.
• What your published banner gives visitors: Google Consent Mode, Global Privacy Control, geo rules and the “Reject all” button. If your draft differs from what is live, the Copilot lists the differences so you know what publishing will change.

The checks

Finding	Severity	Based on
No consent banner appeared	Critical	ePrivacy Art. 5(3), GDPR Art. 7
Cookies set before consent	Critical	ePrivacy Art. 5(3), GDPR Art. 6(1)(a)
Browser storage written before consent	High	ePrivacy Art. 5(3)
Browser fingerprinting before consent	High	ePrivacy Art. 5(3), EDPB Guidelines 2/2023
Trackers contacted before consent	High	ePrivacy Art. 5(3)
“Reject all” has no text	High	EDPB Guidelines 05/2020
Google Consent Mode v2 off while the site uses Google tags	Medium	Google EU user consent policy
Global Privacy Control ignored	Medium	CCPA Regulations § 7025
More than 20% of cookies unclassified	Medium	GDPR Art. 13
No scan yet, the scan couldn’t run the site, or the scan is over 30 days old	Medium	GDPR Art. 5(2)
Google tags send cookieless pings before consent	Low	ePrivacy Art. 5(3); regulator views differ
Cookies that last longer than a year	Low	CNIL guidelines
Cookies without a named provider	Low	GDPR Art. 13(1)(e)

Google tags that load before consent with Consent Mode on send pings without cookies (“Advanced” Consent Mode). Google allows this, so it’s only an advisory. To send nothing before consent, load the Google tag after consent by adding data-cookieboss-category to it (“Basic” mode).

Geo rules

With no geo rules, every visitor gets the opt-in banner. The Copilot shows how your rules apply, the same way the consent script applies them.

Auto-Fix

Some findings have an Auto-Fix button. It first shows exactly what it will change, for example “Google Consent Mode v2: Off → On”. The change is saved to your draft like any other edit, and visitors get it when you publish.

• Google Consent Mode v2 off: turns it on
• Global Privacy Control ignored: turns it on

Every other finding links to the page where you fix it.