Compliance

Switch Measure real-user performance on under Banner → Behaviour and publish. From then on each page view reports three numbers when the visitor leaves the page, and the Performance action on a domain row shows the daily 75th percentile: three in four visits were at least that good.

LCP

Largest Contentful Paint — how long until the main thing on the page is visible. Good is under 2.5 seconds.

INP

Interaction to Next Paint — the worst delay between a tap or click and the page responding. Good is under 200ms. Not reported by every browser, and shown as — rather than zero where it is missing.

CLS

Cumulative Layout Shift — how much the page jumped around while loading. Good is under 0.1. Our banner’s own contribution is 0.000, measured on every build, and it is shown beside yours so the comparison is there to make.

Figures appear after the first full day of traffic, because the daily percentile is computed overnight. Daily numbers are kept for 90 days.

When the share of visitors who accept falls by more than five points against the week before, a What changed panel appears at the top of the dashboard naming the domain and the two figures. It is not there in a normal week — a panel that always says “no change” is a panel nobody reads.

Where something else happened to that domain in the same week, it is named: a banner publish, or a tracker seen on the site for the first time. Those are the two causes behind almost every real drop, and both are already in the record. It is a coincidence in time, not a proven cause, and the wording says so — a confident wrong explanation sends you to change the wrong thing. Where nothing lines up, the panel says that too; a shift in which countries your traffic comes from will move the rate on its own.

The same finding is emailed once a week to anyone who has Consent rate falls sharply on a domain switched on under notifications, and it follows your digest preference like every other optional email.

Compliance scores every domain from its published banner (or the draft, if nothing is published yet). The same number appears on the Domains list and as the chip in the builder, so it never disagrees with itself. The checks:

• Reject is as easy as accept — a Reject-all button on the first screen.
• No scroll-as-consent inside GDPR.
• No pre-ticked categories.
• Granular choice — the visitor can pick categories, not only all or nothing.
• A privacy policy link on the banner.
• Readable contrast between text and background.
• Every language translated — no language added but left in English.
• Something is blocked — a banner with no blocking rules changes nothing on the page.

If a domain has the United States rule set switched on under Banner → Targeting, five more checks apply. They are grouped under their own heading, so a site that serves only Europe never sees them:

• A “Do Not Sell or Share” link reaches the page — the persistent link is only sent under the opt-out rule set, so a site that asks Americans for consent instead never shows one. State law wants the link either way.
• Global Privacy Control is honoured — the tag reads a GPC signal only on the opt-out path. With the US switched off, a browser sending one is ignored, and California treats that signal as a binding opt-out request on its own.
• Sensitive categories stay opt-in — under opt-out everything runs until someone objects, and US state laws carve sensitive data out of that. A category marked sensitive must not also be always-on.
• The opt-out is conspicuous — the link keeps wording a visitor recognises, and the notice is not delayed or auto-dismissed past the point of being seen.
• Every language has its own opt-out notice — under opt-out, a language with no notice of its own shows the default language’s, so a US visitor on your Spanish pages reads it in English. The check names those languages. It is a warning: it lowers the score and never stops you publishing.

The score is also shown per regime, so a Californian problem does not look like a European one. Each failed check has a Resolve link that opens the builder on the exact tab and field.

Behind the scores. Some settings change how a banner behaves without being a rule, so they never move a score. Where one is on, the Compliance screen says what it does for that domain — for example Remember rejections for 6 months, and whether the consent expiry already keeps a rejection for longer, in which case it changes nothing.

Compliance → Rule sets lists every domain with the consent rules its banner applies. Nothing on it is set for the whole workspace — each rule is a setting of one domain’s banner, so the page only shows them and sends you to the builder to change them. The values are read from the published banner, which is what visitors get. A domain that has never been published shows its draft, marked Draft only — not live; one never opened in the builder has no rules to show.

EEA + UK

Always Ask first. Not a setting: consent there is opt-in because the law says so.

United States

Honour opt-outs, Ask first or No banner — set under Banner → Targeting.

Rest of world

Ask first, Tell only or No banner — also under Banner → Targeting. A banner saved before these settings existed is marked as coming from the old region setting, and behaves as it always did.

Consent expiry

How long a decision is honoured before the banner asks again — Ask again after under Banner → Behaviour.

Rejections kept

How long a visitor who rejected everything optional is left alone: the consent expiry, or the rejection memory where that is longer. The memory is Remember rejections for 6 months under Banner → Behaviour; with the expiry already as long, it changes nothing and the page says so.

Blocking

How many scripts are held back until their category is allowed — Banner → Blocking.

Sensitive

Categories marked sensitive on Banner → Content. It only changes anything under Honour opt-outs, where they stay opt-in while everything else runs.

GPC

Honoured exactly when the United States is set to Honour opt-outs; there is nothing else to switch on. Under any other US setting the tag does not read the signal.

Change in the builder on each row opens that domain on the Targeting tab. A change takes effect when you publish: until then your visitors, and this page, still have the published rules.