Verify website privacy compliance with Data Sentry

Data Sentry is a real-time frontend data visibility tool that detects website privacy risks before regulators do. It analyzes the actual network traffic leaving your digital properties, the data packets themselves, to show exactly what personal data is being collected, where it is being sent, and whether each transfer is authorized by the visitor's consent choices. The result is a frontend data map: the same view of your site that regulators and plaintiffs' attorneys assemble when they investigate, available to your team first.

A privacy pentest applies the logic of a security penetration test to data privacy: instead of waiting for an outside party to find your vulnerabilities, you first probe your own digital properties for them. Where a security pentest looks for ways in, a privacy pentest looks for data going out, including trackers firing after opt-outs, consent signals dropped in the adtech chain, and sensitive data flowing to third parties without authorization. Data Sentry is the industry's first privacy pentest for digital properties. You can run a first pass in minutes with the free Privacy Health Check.

A consent management platform captures choices; Data Sentry verifies they're enforced. It inspects the network traffic actually leaving your properties to confirm opt-outs are honored, sensitive data stays put, and IAB and Global Privacy Control signals pass through the adtech chain. It works alongside any CMP, including Ketch Consent Management, as an independent check that banner state matches what tags do at runtime.

Cookie scanners inspect your site's code and inventory the cookies and tags they find, which shows what could collect data. Data Sentry analyzes real-time network traffic, the actual data packets leaving your site, which shows what is being collected and shared, by whom, and whether the visitor authorized it. The difference matters because the risk lives in behavior, not inventory: Ketch research across 134 major websites found that 40% of trackers ignore consumer opt-outs, a violation invisible to a code scan and directly observable in traffic.

Iris is Ketch's patent-pending scanning algorithm. Instead of capping page counts and sampling at random, it groups pages by the specific set of cookies, storage entries, and network calls they fire. Rare trackers concentrate in distinct site sections like a help center or storefront, and cohort-based scanning finds them reliably. Each cycle confirms known trackers and discovers new territory, so coverage compounds instead of resetting every run. That inventory model aligns with expectations like the CPPA Tractor Supply order, which requires quarterly scans and a current inventory of every tracking technology in use.

Yes. Data Sentry can analyze live traffic across web, mobile, and CTV, or ingest the same HAR files plaintiffs' firms use to build CIPA and similar claims. You can verify or refute the allegation yourself and hand legal a response packet built on packet-level evidence rather than a static cookie list.

Three checks that catch what a cookie banner alone can't: broken opt-outs (trackers still firing after consumers opt out), ignored IAB and GPC signals (vendors that fail to respect consent preferences), and unauthorized sensitive data transfers (personal or sensitive data moving to third parties where it shouldn't).

Data Sentry surfaces the frontend vulnerabilities that drive enforcement actions and demand letters: trackers and tags that continue firing after a person opts out, consent signals (including GPC and IAB frameworks) that get dropped somewhere in the adtech chain, sensitive data transferred to third parties without authorization, and misconfigured CMPs that undermine an otherwise compliant program. Each finding is classified by privacy sensitivity and prioritized, so your team sees what to fix first rather than a raw list of network calls.