CookieInspector
How your score is calculated
Last updated: August 18, 2026
No black box. This page lists every signal that moves your number and what each one costs, so you can check our arithmetic and know exactly what to fix first.
Lower is better
The number is a risk score, not a grade. It starts at 0 and climbs as we observe things that create exposure. A site with nothing to flag scores 0; a site loading advertising trackers before anyone clicks anything scores near 100.
This trips people up, so it is worth saying plainly: a high score is bad news.
The three bands
Nothing non-essential fires before consent. There may still be observations worth reading, but none of them is the kind of thing a regulator opens a file over.
Something happens before consent, or the banner does not give a real choice. Usually fixable in an afternoon.
Third-party tracking was observed before the visitor agreed to anything. This is the finding that carries legal exposure, so any site where we see it lands here regardless of how clean the rest is.
One rule overrides the arithmetic: if we see third-party activity before consent on a site that does have a banner, the score cannot land below 70. Everything else about that site may be immaculate — that single finding is the one with legal weight, and we will not let a good average hide it.
What each signal costs
| Signal | Cost | Why it counts |
|---|---|---|
| No consent banner at all | 30 points | Without a banner nothing was ever consented to, so everything the page loads is unconsented by definition. |
| Banner with no way to refuse | 10 points | Refusing has to be as easy as accepting. Regulators have fined this specific asymmetry. |
| Banner that does not block before consent | 5 points | A banner that only informs while tags load anyway is decoration, not consent. |
| Third-party cookies set before consent | 3 points each, up to 25 | Cookies dropped by someone else's domain before the visitor agreed. The consent platform's own cookies and strictly necessary services are excluded. |
| Tracking scripts present | 3 to 20 points | Scaled by how many. Analytics and advertising scripts are what the rules are about. |
| Each serious issue found | 15 points | Things like third-party tracking before consent, or a banner whose reject button does not actually stop anything. |
| Each moderate issue found | 6 points | Weaker signals: delayed banners, external API calls that may carry tracking, and similar. |
What we deliberately do not count
- Cookies that appear only after the visitor accepted. That is what consent is for — a site that defers every tag until someone clicks Accept is doing it right, and we do not charge for it.
- Cookies belonging to your consent platform itself, and to strictly necessary services like security, payment and CDN.
- The same problem twice. Each finding is priced once, whether it shows up as a headline factor or in the issue list.
Multi-page scans
We scan several pages and your headline score is the worst one, not the average. You are only as compliant as your most exposed page, and averaging would let a clean home page bury a leaky checkout. The report lists every page scanned with its own score so you can see where the risk actually sits.
Your own report shows the working
Every report has a “How this score was calculated” section listing the signals we actually observed on your site and the factors that were applied. Read this page alongside it and the number should reconcile.
If it does not, tell us at support@cookieinspector.com. A score you cannot verify is not worth much, and we would rather fix the arithmetic than defend it.
No legal advice
This score is a technical measurement of what your site loads and when. It is not a legal opinion, and it is not a certification.