What this service is
The CMP service assesses whether a client’s website properly controls which cookies and tracking scripts fire before, during, and after a user provides consent. Most websites—even those with a visible cookie banner—are out of compliance: trackers fire before consent is given, reject buttons are buried or absent, and privacy documentation is incomplete or inaccurate.
Northwoods has built an advanced agentic scanning tool that automates this entire assessment. It inventories every cookie and tracking script, tests the consent mechanism, verifies privacy documentation, and produces a scored compliance report with a prioritized remediation plan—all without manual effort from the specialist.
Why clients care: GDPR fines reach €20M or 4% of global annual revenue. CCPA/CPRA penalties run up to $7,500 per intentional violation. ADA-style lawsuits targeting cookie consent are increasing. Most clients have no idea what’s firing on their site before a user clicks “Accept.”
E
Eric / Gerry
CMP Practice Lead — Privacy & Consent Management
Eric recently was assigned the task of growing the CMP practice at Northwoods and has starting overseeing the Gerry's agentic assessment tool built by Gerry in Q4-25 and Q1-26. He is one of the subject matter experts for client-facing compliance questions, audit methodology, and remediation guidance. For M/L engagements, Eric will lead the consulting conversation and the remediation planning session. A public-facing Quick Scan variant is currently in final development.
Service tiers — F / S / M / L
F — Free / Quick Scan
Quick Scan
Free
Self-serve • Homepage only • ~30 seconds
- ✓ CMP vendor detected
- ✓ Cookie banner present
- ✓ Reject / Decline button present
- ✓ Cookie count (first-party vs. third-party)
- ✓ Pre-consent tracking detected
- ✓ Privacy policy link present
- ✓ Overall compliance level estimate
Scope: Homepage • Agentic: Yes • No account required
S — Paid Deeper Scan
Detailed Scan
~$200
Email-gated • Homepage + key pages • Agent-generated
- ✓ Everything in Quick Scan
- ✓ Full 5-level compliance score
- ✓ Complete cookie inventory table
- ✓ Tracking script detection (GTM, GA4, HubSpot…)
- ✓ Consent Mode v2 implementation check
- ✓ SRI (Subresource Integrity) coverage
- ✓ Cookie policy & DSAR documentation check
- ✓ Remediation summary
Scope: Homepage + 5–10 pages • Agentic: Yes • Delivered via branded report
M — Audit & Consult
Full Audit
$$$
Scoped engagement • Full site • Agent + Eric review
- ✓ Everything in Detailed Scan
- ✓ Manual GPC signal testing
- ✓ Geographic consent behavior analysis
- ✓ Attribution cookie tracking (gclid, utm…)
- ✓ Campaign parameter simulation
- ✓ Prioritized remediation plan (HIGH / MED / LOW)
- ✓ Draft client outreach email
- ✓ Expert consultation with Eric
- ✓ Quarterly audit scheduling
Scope: Full site • Agentic + Eric review • Live 1–2 hr consultation
L — Retainer
Ongoing Compliance
Retainer
Monthly retainer • Recurring audits • Dashboard tracking
- ✓ Everything in Audit & Consult
- ✓ Quarterly recurring full-site audits
- ✓ KPI tracking on client dashboard
- ✓ Monthly progress review meetings
- ✓ Included remediation hours
- ✓ Proactive compliance monitoring
- ✓ Regulatory change alerts
Scope: Full site • Ongoing • Eric + Agent • Dashboard KPIs
What the agent checks
| Check |
F — Free |
S — Paid |
M — Audit |
| Consent Mechanism |
| CMP vendor identified (OneTrust, Termly, Cookiebot…) | ✓ | ✓ | ✓ |
| Cookie banner present on first visit | ✓ | ✓ | ✓ |
| Reject / Decline All button available | ✓ | ✓ | ✓ |
| Pre-consent tracking prevention | ✓ | ✓ | ✓ |
| Rejection persistence across page reloads | — | ✓ | ✓ |
| Consent preference cookie correctly stored | — | ✓ | ✓ |
| Consent Mode v2 update events | — | ✓ | ✓ |
| GPC (Global Privacy Control) signal handling | — | — | ✓ |
| Geographic consent behavior (VPN simulation) | — | — | ✓ |
| Cookie & Tracking Inventory |
| Total cookie count (first-party vs. third-party) | ✓ | ✓ | ✓ |
| Cookie inventory table (name, category, duration, flags, source) | — | ✓ | ✓ |
| Tracking script detection (GTM, GA4, HubSpot, Meta Pixel…) | — | ✓ | ✓ |
| SRI (Subresource Integrity) coverage on external scripts | — | ✓ | ✓ |
| Attribution cookie tracking (gclid, utm parameters) | — | — | ✓ |
| Campaign parameter simulation (Google, Meta, LinkedIn) | — | — | ✓ |
| Privacy Documentation |
| Privacy policy present and accessible | ✓ | ✓ | ✓ |
| Cookie policy present | — | ✓ | ✓ |
| DSAR (Data Subject Access Request) process documented | — | ✓ | ✓ |
| Explicit GDPR / CCPA regulatory references | — | ✓ | ✓ |
| Scoring & Remediation |
| Privacy category score (0–100, Red/Yellow/Green) | △ | ✓ | ✓ |
| Prioritized remediation plan (HIGH / MED / LOW) | — | △ | ✓ |
| Expert review & consulting with Eric | — | — | ✓ |
✓ Included △ Partial / estimated — Not included
How this service is delivered today
Step 1
Agent Scans
Gerry’s agentic tool runs the full CMP assessment against the client’s site. Produces raw structured report.
Gerry — Agent tooling
Step 2
Raw Report
Structured HTML report output at the assessments API endpoint. Contains all findings, cookie inventory, and remediation plan.
Automated
Step 3
Polish & Brand
Hayden takes the raw report into Lovable and produces the client-facing branded version with visual design and formatting.
Hayden — Lovable
Step 4
Client Delivery
Branded report shared with client. For Full Audit engagements, Eric leads a consulting session on the remediation plan.
Eric — CMP Lead
Coming soon: A public-facing Quick Scan variation is nearly complete and will be available directly on the NWS website. Prospects will be able to scan their own homepage for free, with no friction, as the top-of-funnel entry point for the Compass program.
L-tier dashboard KPIs
For retainer clients, these metrics are tracked on the Compass client dashboard and reviewed in quarterly consulting sessions with Eric. They give clients a continuous, measurable view of their compliance posture and remediation progress.
| KPI |
What it measures |
| Privacy Category Score (0–100) |
The client’s Privacy score on the Compass effectiveness grid (0–100, banded Red/Yellow/Green), re-assessed each quarter. A rising score over time is the primary success signal for retainer engagements. |
| Pre-Consent Tracker Count |
Number of trackers (cookies, pixels, scripts) that fire before a user grants consent. Target: 0. Even one pre-consent tracker is a GDPR and CCPA violation. Tracked per crawl to detect regressions from CMS updates or new tag manager deployments. |
| Third-Party Cookie Count |
Total third-party cookies detected in the most recent crawl, compared against the prior period. A rising count without corresponding consent coverage signals new tracking exposure. Target: stable or declining; all third-party cookies categorized and disclosed. |
| Remediation Backlog Closure Rate |
Percentage of identified remediation items from the Full Audit that have been resolved. Tracked against the original prioritized action list. High-priority items (30-day) are flagged if still open. Target: all High items closed within 60 days of audit delivery. |
Features & benefits
What makes this service distinctive
- Fully automated agentic scanning — no manual setup per client
- Cookie inventory down to name, category, duration, flags, and source
- GPC signal testing goes beyond what most agencies check
- SRI coverage analysis surfaces supply-chain risk most clients don’t know exists
- Remediation plan is prioritized by urgency, complexity, and regulatory exposure
- Branded client report produced by Hayden in Lovable — visually polished
- Draft client outreach email included in Full Audit deliverable
- Legal references (GDPR, CCPA/CPRA, ePrivacy) built into every finding
- Works on any CMS — Titan, WordPress, HubSpot, custom builds
Client benefits
- Understand exactly what is tracking their users, and when, before a regulator does
- Reduce legal exposure from GDPR, CCPA/CPRA, and ePrivacy violations
- Fix the reject-button problem before it becomes a lawsuit or a fine
- Get a clear, phased remediation roadmap — not just a list of problems
- Quarterly audit cadence keeps compliance current as regulations and CMPs evolve
› Service Reference › Privacy & Compliance