CMP — Privacy & Consent Management Cookie & Analytics Tracking Compliance

What this service is

The CMP service assesses whether a client’s website properly controls which cookies and tracking scripts fire before, during, and after a user provides consent. Most websites—even those with a visible cookie banner—are out of compliance: trackers fire before consent is given, reject buttons are buried or absent, and privacy documentation is incomplete or inaccurate.

Northwoods has built an advanced agentic scanning tool that automates this entire assessment. It inventories every cookie and tracking script, tests the consent mechanism, verifies privacy documentation, and produces a scored compliance report with a prioritized remediation plan—all without manual effort from the specialist.

Service tiers — S / M / L

What the agent checks

✓ Included    △ Partial / estimated    — Not included

The 5-level compliance framework

Every assessment produces a compliance level from 1 to 5. This gives clients a clear benchmark, a gap to close, and a basis for measuring progress over time.

Example: a Level 4 client has one level to close — the assessment report shows exactly what stands between them and Level 5.

Sample output — Quick Scan

This is representative of what a prospect sees when they run a free scan of their homepage on the NWS website.

Sample output — Remediation plan (Full Audit)

The Full Audit produces a prioritized action list with complexity ratings, dependencies, and regulatory rationale. Example below is based on a real assessment.

Deliverables by tier

How this service is delivered today

Features & benefits

What makes this service distinctive

• Fully automated agentic scanning — no manual setup per client
• 5-level compliance framework gives clients a benchmark and a clear target
• Cookie inventory down to name, category, duration, flags, and source
• GPC signal testing goes beyond what most agencies check
• SRI coverage analysis surfaces supply-chain risk most clients don’t know exists
• Remediation plan is prioritized by urgency, complexity, and regulatory exposure
• Branded client report produced by Hayden in Lovable — visually polished
• Draft client outreach email included in Full Audit deliverable
• Legal references (GDPR, CCPA/CPRA, ePrivacy) built into every finding
• Works on any CMS — Titan, WordPress, HubSpot, custom builds

Client benefits

• Understand exactly what is tracking their users, and when, before a regulator does
• Reduce legal exposure from GDPR, CCPA/CPRA, and ePrivacy violations
• Fix the reject-button problem before it becomes a lawsuit or a fine
• Get a clear, phased remediation roadmap — not just a list of problems
• Quarterly audit cadence keeps compliance current as regulations and CMPs evolve

What the client-facing report looks like

After the agent produces its raw assessment, Hayden takes the structured output and renders a polished, branded client report using Lovable. The following images are taken directly from a real Northwoods CMP report delivered to a client.

Cover — Score & Metadata

What the client sees first: A risk score out of 100 with a plain-language rating (e.g., “Critical Gaps”), the number of items assessed, their domain, CMS platform, consent platform, analytics configuration, and total cookie count — all pulled automatically by the agent.

Compliance Status — Item-by-Item Findings

Every check is explained in plain language. Each item receives a status (Compliant / Non-Compliant / Partial) with a specific note describing exactly what the agent found — including the script names, cookie names, and technical reasons behind each finding.

Compliance Level — 1–5 Framework

The compliance level visual shows the client exactly where they are today, where they need to be, and how many levels separate them from the target. This becomes the benchmark all future assessments measure against.

Remediation Roadmap — Prioritized Steps

Each remediation step is actionable, not generic. Steps are numbered, prioritized (HIGH / MEDIUM), and include complexity ratings, what they depend on, and the specific regulatory article that requires the fix — so the client can assign work immediately and defend decisions internally.

Critical Compliance Issues — Evidence

Critical issues include evidence. The report names the specific cookies and scripts involved, shows the actual values found (e.g., cookie names, parameter strings), and cites the applicable regulation — providing everything needed for a developer to act or a legal team to assess exposure.

Summary of Findings & Recommended Path Forward

The summary is written for stakeholders. One section shows the current state in a single sentence, lists the critical issues at a glance, and states the recommended path forward — designed to be shared with a client’s leadership team without additional explanation.