We open the website in a real browser, click Accept on the consent banner, and record every cookie that gets set during the visit. We do this five times in a row.
We also pull the cookies our nightly compliance monitoring has recorded for this site over the last 30 days.
1920×1080, locale cs-CZ, timezone Europe/Prague5 stealth-headless + 1 headed with mouse moves + 1 baseline = 7 total8 seconds after the Accept click — late-loading trackers within this window are caught30 days3 of 5 trialsOnline advertising is auction-based. Every time a page loads, ad networks bid for the slot in real time, and a different bidder usually wins. The winning bidder sets its cookies. The next visit, a different bidder wins, and a different set of cookies appears.
That's why we run five scans — to tell the difference between cookies that always fire on the site and cookies that only show up some of the time. Both still count for compliance: a cookie set even once before consent is a problem.
The combination that matters: Seen by users + In monitoring = a cookie that every visitor gets, but our compliance system has no record of. That's the gap.
Each tab is filtered by when the cookie was first set, relative to the moment we clicked Accept:
The time value (e.g. −3.2s) is how many seconds before or after the Accept click the cookie first appeared in any of the five scans.