We Scanned 4 Compliance Tools With Our Own Scanner. Here's What We Found.

Updated August 13, 2026. We re-ran this audit with ComplyTest's current engine — 70 rules, up from 47 in March. Nothing below is overwritten: the original March findings are preserved in full under "March 2026 baseline." The new section comes first because it's the current state of the world.

We build ComplyTest, an open-source compliance scanner now running 70 rules across consent, accessibility, security, and transparency. We also build Complicer, a SaaS platform on top of it.

We asked the same question we asked in March: do compliance tools pass their own compliance checks?

We scanned the same four vendors' public sites. The answer is still mostly no — with one genuine exception, and one vendor whose site doesn't exist in the same form anymore.

Methodology (August 2026)

ComplyTest now runs 70 automated checks in 5 categories:

• Consent (20 rules): Everything from March, plus new checks for granular per-category controls, partial-rejection cookie persistence, cookie-description clarity, and Privacy Sandbox API disclosure. Consent effectiveness — click "Reject All," then watch the network tab to confirm trackers actually stop — is still the core test.
• Accessibility (21 rules): WCAG 2.2 AA, including the newer target-size and focus-appearance success criteria that didn't exist in the March rule set.
• Security (20 rules): HTTP security headers, CSP quality grading, cookie security flags, and Subresource Integrity.
• Transparency (6 rules): Privacy policy, terms of service, data controller identification, contact information, complaint mechanism.
• Privacy Sandbox (3 rules): Topics API, Attribution Reporting, and CHIPS usage disclosure — new since March. All three reachable sites passed all three cleanly, so we don't break this out per-site below.

All scans were run on August 13, 2026, using Playwright with a real Chromium browser and a 180-second page timeout (prod parity — the CLI's 30-second default under-reports on slower sites). Same methodology as March: no shortcuts, no synthetic data, and a scan that can't verify something reports "inconclusive" or "blocked" rather than getting rounded up to a pass.

The Scorecard — August 2026 (engine 1.1.0, 70 rules)

Scores are the engine's own reported figures (Score: N%), quoted directly from the CLI output — not independently recomputed.

Cookiebot — 70% (47/70 rules passed)

What we found (August 2026):

• Consent enforcement FAILED — 2 Google Analytics requests fire after clicking Reject. This is the engine's consent.effectiveness rule, the one that matters most, and it's a fail: "2 analytics request(s) after consent rejection (high-prevalence tracker detected)."
• No reject button on the first layer of the banner — our automated reject path needed a second interaction to even reach a reject control.
• CSP quality: Grade F — unsafe-inline and unsafe-eval are both still present. Unchanged from March.
• No skip navigation link, 1 image missing alt text, and 7 elements with focus indicators under the WCAG 2.2 2px minimum.
• Google Consent Mode: no "default" call found — consent state isn't set before tags fire.

Cookiebot is still the highest scorer of the four, and its accessibility (17/21) and transparency (5/6) are solid. But the one test built specifically for a consent-management company — does Reject actually stop tracking — still fails.

OneTrust — 68% (46/70 rules passed)

What we found (August 2026):

• Reject now works. This is the one real improvement we found across all four vendors. The engine's consent.effectiveness rule passed: "Consent enforcement is effective - no tracking after rejection (reject click verified)." In March, OneTrust set 2 cookies before consent and had no verified reject path.
• It's not a clean pass, though: 1 non-essential cookie is still set before consent (timestamp-verified), and 12 non-essential cookies persist after a partial/granular rejection — so "reject all" works, but partial consent doesn't fully honor the choice.
• Accept/Reject visual parity failure persists — same dark pattern flagged in March.
• Accessibility dropped to a C (71/100, 151 weighted violations) — the weakest accessibility result of the four this round. Not directly comparable to March's 13/16 on the old 16-rule accessibility set, since the rule set itself grew from 16 rules to 21, including new WCAG 2.2 checks, but it's the number today.
• CSP quality Grade D. (Google Consent Mode isn't a finding here either way — the engine's rule reports "No Google tags detected, rule not applicable." OneTrust's marketing site doesn't run Google tags in this scan, so there's nothing to grade on that axis.)

OneTrust is the one vendor where the headline claim softened: the mechanism they sell — a working reject button — verifiably works now. The rest of their consent posture (pre-consent cookies, partial-rejection leakage, no cookie withdrawal mechanism) still falls short of what they sell.

Monsido — blocked, brand folded into Acquia

What we found (August 2026):

• https://www.monsido.com — the URL from the March audit — returns an HTTP 404 on scan navigation. Per our own honesty rule, a blocked scan is reported as blocked, not rounded up or down to a grade: all 70 rules come back inconclusive, and no score is assigned.
• The bare https://monsido.com (no www) 301-redirects to https://www.acquia.com. The page title our scanner captured there: "Digital Experience Platform for Content, Community, Commerce | Acquia" — Acquia's flagship corporate site, not a Monsido-branded page.
• For transparency: we did run the engine against whatever monsido.com currently resolves to, out of curiosity. It scored 66% (42/70). We are not presenting that number as "Monsido's new score" — it describes Acquia's flagship marketing site, an unrelated and much larger surface, not a continuation of the March audit subject. Publishing it as a like-for-like comparison would be exactly the kind of rounding-up we built this scanner to refuse to do.
• Net finding: Monsido, as an independently addressable product site, does not appear to exist anymore in the form we audited in March.

Deque — 70% (46/70 rules passed)

What we found (August 2026):

• Consent effectiveness: INCONCLUSIVE, not verified-fail. The banner-detection rule actually found a reject button on the first layer, but our interaction step couldn't click it this run ("No reject button found for consent interaction" — a click failure, not an absence). Because of that, the engine's own message is: "banner did not reappear after storage clear; the rejected state could not be verified, so no enforcement claim is made." We do not know whether Deque's consent experience changed since March or whether our automation just missed the click — and we're not going to repeat March's "fails to enforce Reject" claim on a run where we couldn't actually test it.
• Security dropped to a D (Observatory-style, 40/100) — no CSP, no X-Frame-Options, no X-Content-Type-Options, and HSTS max-age is still only 300 seconds, unchanged from March's finding.
• Accessibility remains the strongest of the four — 19/21 (99/100), though not the perfect 16/16 from March. The rule set grew from 16 rules to 21 since then, so this isn't a regression so much as a bigger bar.
• 8 cookies missing the Secure flag.

Deque's honesty-relevant story this round isn't "still failing consent" — it's "we can't currently verify their consent path either way," and we're reporting that distinction on purpose.

What Changed Since March

The percentages above aren't directly comparable — the rule count grew from 47 to 70 (new WCAG 2.2 target-size and focus checks, Privacy Sandbox disclosure, granular-consent and partial-rejection checks all landed since March), so a higher score doesn't mean "got better" and a lower one doesn't mean "got worse."

What is directly comparable, because it's the same test regardless of how many other rules exist, is consent effectiveness — does clicking Reject actually stop tracking:

• Cookiebot: fails both times — different specific leak, same underlying failure.
• OneTrust: failed in March, verified effective now. The one real improvement in this whole audit.
• Deque: verified-fail in March, inconclusive now — we couldn't test the reject path this run, so we're not claiming it still fails.
• Monsido: not comparable — the original site no longer resolves to an independent product page.

March 2026 baseline (engine 0.x, 47 rules)

Preserved as originally published, unchanged except for one added note on Monsido's current availability — it's the historical record the section above is measured against.

Original Methodology

ComplyTest ran 47 automated checks in 4 categories:

• Consent (11 rules): Cookie behavior before/after consent, banner design, visual parity, Google Consent Mode, and our killer feature — consent effectiveness testing. We click "Reject All" and verify that trackers actually stop firing.
• Accessibility (16 rules): WCAG 2.2 AA coverage including color contrast, heading hierarchy, ARIA validation, skip navigation, target sizes, and landmark regions.
• Security (14 rules): HTTP security headers (CSP, HSTS, X-Frame-Options), cookie security flags, Subresource Integrity, and CSP quality grading.
• Transparency (6 rules): Privacy policy, terms of service, data controller identification, contact information, and complaint mechanism.

All scans were performed on March 19, 2026, using Playwright with a real Chromium browser. No shortcuts, no synthetic data.

The Original Scorecard

No site scored above 64%. Three out of four scored 60% or below. The highest individual category score belonged to Deque on accessibility: a perfect 16/16. The lowest belonged to Monsido on consent: 3/11.

Cookiebot — 64% (30/47)

What they claim: "The most used solution for compliant use of cookies." Google Gold Tier CMP Partner. 13,000+ pre-categorized trackers. Serves 2.4 million websites.

What we found:

• Sets cookies before consent — the very thing their product exists to prevent.
• Accept/Reject buttons lack visual parity — the Accept button is visually more prominent than Reject, a dark pattern that GDPR guidance explicitly warns against.
• Google Consent Mode defaults not configured — despite being a Google Gold Tier partner.
• No skip navigation link — accessibility basics missing.
• Buttons below 24×24px minimum — WCAG 2.2 target size failures (16×19px measured).
• CSP quality: Grade F — no meaningful Content Security Policy in place.

Cookiebot scored the highest of the four, which is worth acknowledging. Their consent structure is better than most. But the consent management company still can't fully manage its own consent.

OneTrust — 60% (28/47)

What they claim: "The AI-Ready Governance Platform." Named Leader in 2025 IDC MarketScape. Trusted by Walgreens, Atlassian, Adobe, Pfizer, and Samsung.

What we found:

• 2 cookies set before consent — a direct violation of GDPR's prior consent requirement.
• 12 cookies exceed the 12-month expiration limit — against CNIL and ICO published guidelines.
• Accept/Reject visual parity failure — the same dark pattern as Cookiebot.
• Still running Google Consent Mode v1 — v2 has been required since March 2024, over two years ago.
• No Content-Security-Policy header — the world's largest privacy platform has no CSP.
• 5 cookies missing the Secure flag — basic cookie security absent.

OneTrust's consent scores (5/11) reflect an organisation that has not applied its own product rigor to its own marketing site. The Google Consent Mode failure is particularly notable: v2 became mandatory two years ago, and OneTrust sells GCM configuration as a feature.

Monsido — 60% (28/47)

What they claim: "Optimize Content for Accessible Websites." WCAG 2.1 AA compliance scanning. GDPR consent management (available as an add-on). Now part of Acquia.

What we found:

• No Reject button at all — the consent banner offers no way to refuse cookies. This is a clear GDPR violation under CJEU case law (Planet49, C-673/17).
• 13 non-essential cookies + 2 third-party cookies loaded before consent — the worst pre-consent cookie behavior of all four competitors.
• Banner uses complex legal jargon — fails the GDPR requirement for clear and plain language.
• Google Consent Mode not configured — despite Google Tag Manager being present on the page.
• No Terms of Service link — a basic transparency gap.

Monsido scores the lowest on consent (3/11) despite selling consent management as a product feature. The absence of a Reject button is not an edge case or a misconfiguration — it is a structural GDPR violation, and it is on their homepage.

(As of the August 2026 refresh above, this is no longer testable — the original site now returns an HTTP 404, and the bare domain redirects to Acquia's flagship site.)

Deque — 62% (29/47)

What they claim: "Digital accessibility done right." Forrester Wave Leader. axe-core, with 3 billion+ downloads. "Zero false positives." 8,000+ accessibility audits completed.

What we found:

• Perfect 16/16 on accessibility — Deque absolutely walks the talk here. Every WCAG 2.2 AA check passed. No color contrast failures, no missing ARIA labels, no target size issues.
• 12 cookies set before consent — tied with Monsido for the worst pre-consent cookie count.
• Analytics requests continue after clicking Reject — consent enforcement failed. This is our most important test: we click Reject All, then monitor network traffic to verify that analytics and tracking requests stop. Deque's site continued sending analytics data after rejection.
• 13 cookies missing the Secure flag — basic cookie security absent across the board.
• HSTS max-age of only 300 seconds — effectively useless. The recommended value is 31,536,000 (one year). 300 seconds means HSTS protection lapses every five minutes.

Deque's accessibility score is the best result in our entire test. Their consent posture is among the worst. They do not sell consent management tools, but they are still responsible for GDPR compliance on their own site — and on that measure, they fall short.

What This Means

Every compliance tool we've been able to test — in March and again in August — fails its own compliance standards on at least one axis that matters. One vendor closed the gap on the metric we care about most (OneTrust's reject button now verifiably works). One vendor's original site no longer exists in a testable form. The other two still leak tracking data past a rejection, or we can no longer verify that they don't.

This is not a gotcha exercise. It is a data point about how the industry works, twice now, five months apart. Each company still excels in the domain they sell: Deque's accessibility remains the strongest result in our test, Cookiebot still has the most coherent consent structure of the three we could fully test. But nobody is checking the full picture end to end, continuously. Consent teams do not own security headers. Accessibility teams do not audit cookie behavior. The result is a fragmented compliance posture that looks good in demos and drifts in practice — sometimes for the better, as OneTrust shows, and sometimes into "we can't tell anymore," as Deque and Monsido show.

This is exactly the problem ComplyTest was built to solve: a single scanner that checks consent, accessibility, security, and transparency in one pass, against a fixed ruleset, using a real browser. No cherry-picking, no category silos, and no rounding an inconclusive or blocked result up to a pass.

And it is the problem Complicer is built to fix downstream — taking those scan results and turning them into prioritised remediation, AI-assisted classification, and regulator-ready evidence packages.

The compliance tools themselves are not bad products. But compliance is not just what you sell. It is also how you operate — and whether you keep operating it the same way five months later.

Try It Yourself

ComplyTest is open source. Run it against any website:

npx complytest scan https://your-site.com

70 rules. 5 categories. Real browser testing. No signup required.

Want automated monitoring, AI-powered classification, and regulator-ready evidence packages? That's what Complicer does.

Start your free audit →