What does your website do when a visitor clicks “Reject”?
Rejekto opens your website in a clean browser, clicks the cookie banner for the visitor and shows what started before consent and after rejection. We don't sell cookie banners, so we assess them independently.
No sign-up. One scan per domain every 24 hours. We test publicly available pages only. By submitting you agree to the terms of use.
- google-analytics.com · _ga 2 yearsbefore consent
- fonts.gstatic.comoutside the EU
- connect.facebook.net · _fbp 90 daysafter rejection
Why we're different
We don't sell banners.
A banner collects consent. Whether the website respects it is another question. We assess it without wanting to sell you a different one.
We really click “Reject”.
Then we load the page again and show whether tracking stopped or only the banner disappeared. On desktop and mobile.
We know the Slovak and Czech web.
Gemius, ETARGET, R2B2, CPEx, Sklik, Heureka, Glami and other networks are recognised by Rejekto and attributed to their provider.
The tool finds the problem. Our people help you fix it.
Rejekto is operated by IOSEC. The IOSEC group has more than 17,000 GDPR clients in eight European countries, so you are not left alone with the report.
- 01 · free
Scan
Within a minute you know what the website does before consent and after rejection.
- 02
Fix
A report with findings and evidence that tells the developer what to change.
- 03
Policies
Cookie and privacy policies based on what the scan actually found.
- 04
Data protection officer
Ongoing oversight of data protection. IOSEC performs this role for its clients.
We operate directly or through partners in Slovakia, Czechia, Poland, Hungary, Austria, Germany, Romania and Greece, and can offer most services in almost any EU country.
We have Cookiebot or CookieYes. Why Rejekto?
Cookie banner
- Asks the visitor for consent.
- Stores the choice.
- Its job is not to verify whether the rest of the website respects it.
Rejekto
- Verifies what the website does after rejection.
- Works with any banner: in-house, open-source or commercial.
- Backs every finding with a request, cookie or screenshot.
Keep your banner. Rejekto tells you whether it does what it promises.
How it works
- 01
We load the page without clicking.
We record every request and cookie created before the visitor decides anything.
- 02
We click both “Accept” and “Reject”.
Each scenario runs in a new, clean browser. After rejection we reload the page and check whether the site respects the choice.
- 03
You get a report.
A score from 0 to 100, a list of findings with evidence (request, cookie, banner screenshot), where visitor data goes and what to do about it.
What you will learn
- Which analytics and advertising tools run before consent.
- Whether the site really stops tracking after rejection, or just hides the banner.
- Whether the banner has a “Reject” button on the first layer and whether it is as visible as “Accept”.
- Which cookies are set, how long they live and who sets them.
- Where data goes: fonts, maps, videos, chat and CDNs outside the EU.
- Whether the page treats scrolling as consent and what loads only when you scroll.
- Basic security headers and the redirect to HTTPS.
The banner went away. The tracking did not.
What your cookie banner cannot tell you
A banner collects consent. Whether the website then respects it is a different question. Rejekto does not sell banners, so it checks them independently.
- We really click “Reject” and reload the page. You see whether tracking stopped or only the banner disappeared.
- Works with any banner, your own, open source or commercial.
- In numbers, not impressions: how many third-party services run before a click, after consent and after rejection, and how many of them track.
- We see what hides, too: measurement through the website’s own domain, pixels, Consent Mode pings, fonts, videos and chat.
- Transfers outside the EU, by name. For each provider we state its EU contracting entity, country and EU-U.S. DPF status from the official list. What we cannot source from the provider’s own documents, we leave out.
- We never score what we did not see. If a website refuses the scanner, the scan gets no score and the report says so.
- We know the Slovak and Czech networks, too: Gemius, ETARGET, R2B2, CPEx, Sklik, Heureka, Glami and more.
A privacy policy that matches your website
A privacy policy should describe what the website actually does: which cookies it sets, which services it loads and where data goes. The scan shows you that in black and white. Based on it, IOSEC's privacy experts prepare the privacy policy and cookie notice for your website.
- Based on the scan: the list of cookies, providers and transfers outside the EU, not an estimate.
- Privacy experts: IOSEC also serves as an external data protection officer.
Monitor all your client websites. Every week, automatically.
You manage dozens of websites and a client changes a tracker without telling you. Rejekto finds out for you.
- Weekly scan of every domain, desktop and mobile.
- Comparison with the previous state: new tracker, new cookie, score drop.
- Tracking after rejection for every website: one number you can explain to a client in a minute.
- E-mail alert when something changes. Not a dashboard nobody reads.
- Report with your logo that you send to the client as your own service.
- History and PDF for every website.
| Website | Score | Tracking after rejection |
|---|---|---|
| client-a.com | 94 | 0 |
| client-b.com | 88 | 0 |
| client-c.com | 91 | 0 |
| client-shop.com | 61 | 5 |
+ new tracker: TikTok Pixel (before consent) · score 86 → 61
The consent check also runs in your CI pipeline after every deployment: guide for GitLab CI and GitHub Actions.
Why you can trust us
Your data stays with us.
Scans run on our own infrastructure in the EU. We do not send results to any third-party service.
This site has no cookies and no trackers.
We check it regularly with our own tool. Current score: 100.
Evidence, not impressions.
Every finding has a specific request, cookie or screenshot.
A technical audit, not legal advice.
We show what the website does. If you need a GDPR compliance assessment, processes or a data protection officer, IOSEC's privacy experts can help.
Privacy services →Frequently asked questions
Is this legal?
We test what every visitor sees in an ordinary browser. We do not exploit vulnerabilities or bypass any protection.
Why does a scan sometimes fail?
Some websites use bot protection or a firewall that refuses our browser (for example a “Verify you are human” challenge or HTTP 403). We say so in the report and the scan is not rated. We do not bypass it. If you manage the website, you can allow the scanner: How to allow Rejekto in your firewall.
How long is the report available?
The free report stays available for 7 days. Then it is deleted together with the screenshots.
What does the score mean?
100 points is a website with no findings. Critical findings, such as a tracker running despite rejection, cost the most points. The score is a technical rating, not a legal verdict.
Do you test subpages too?
For now only the submitted page. For agencies we are preparing scans of several pages per website.