Privacy Policy — Consent Inspector
Last updated: 6 September 2026.
The short version
Consent Inspector does not have a server that receives your data. Everything an audit produces stays in your browser. There is no account, no tracking inside the extension, and nothing is sold or shared.
What the extension collects, precisely
During an audit — and only while an audit is running — the extension records, on your device:
| Recorded | Not recorded |
|---|---|
| Hostname, path and HTTP method of outgoing requests | Request bodies and headers |
| Names of query parameters | Values of query parameters (replaced by their character length) |
Values of a short allow-list of consent-state parameters: gcs, gcd, dma, dma_cps, npa, gdpr, gdpr_consent, us_privacy, gpp, gpp_sid, tid, en, ev | Any other parameter value |
dataLayer event names and consent commands | Other dataLayer payload contents |
Cookie names and attributes (Secure, SameSite, session vs persistent) | Cookie values — never |
| Presence and status of the IAB TCF API, and the length of the TC string | The TC string itself |
Whether navigator.globalPrivacyControl is set | — |
| The URL of the page you chose to audit | Any other page you visit |
The extension never reads page content, form input, passwords or anything you type.
Why these specific fields
Each one maps to a check the extension performs. Parameter *values* are dropped because they are the only place personal data realistically appears in a tracking beacon — and the audit does not need them to do its job. The consent-state allow-list exists because those particular parameters encode the consent signal itself, which is the object of the audit; none of them carries personal data.
This is the "strictly necessary to the disclosed single purpose" standard the Chrome Web Store requires, applied literally.
Where the data goes
- Audits are stored in
chrome.storage.localon the device that ran them. - Preferences are stored in
chrome.storage.sync, which means they travel through your own Chrome profile if you have Chrome Sync enabled. That is a Google service under your control; the developer has no access to it. - Nothing is transmitted to the developer or to any third party.
There are no exceptions. This extension is free, has no accounts, no licences and no paid tier, so it never contacts any server for any reason. It makes zero outbound network requests of its own — you can verify that in DevTools, or by reading src/background/service-worker.js, which contains no fetch call at all.
Exports
When you export a report, the file is generated in your browser and saved by you. It is not uploaded anywhere. Note that an exported report does contain the audited URL and the hostnames of the vendors found — treat it like any other client document.
Permissions and why each one exists
| Permission | Why |
|---|---|
storage | Save audits and preferences locally. |
scripting | Inject the observation scripts into the page you chose to audit. |
activeTab | Read the URL of the tab you are on, when you open the popup. |
| Host access (optional, per-domain) | Observe network requests from the first byte. Requested one domain at a time, only when you start an audit, and revocable at any moment from chrome://extensions. |
This extension never requests access to all sites.
Data retention and deletion
The most recent 200 are kept on this device. Older ones are discarded automatically. You can delete any individual audit, or all of them, from the Settings page. Uninstalling the extension removes all local data.
Uninstall
Nothing happens when you uninstall. Most extensions open a survey page on uninstall; this one does not, because that would mean depending on a website that has to stay up. All local data is removed by Chrome when the extension is uninstalled.
Children
This is a professional developer tool. It is not directed at children and does not knowingly collect data from anyone.
Changes
If the data practices ever change, the extension will notify you inside the product before the change takes effect, as the Chrome Web Store disclosure policy requires. This document will be updated with a new date.
Contact
faustino20161@gmail.com