# Continuous compliance monitoring

Run refusal scans on demand with fast, deep or ultra profiles, monitor representative pages weekly, and get alerted the day a regression appears.

> Canonical: https://www.flowconsent.com/en/doc/compliance-monitoring
> Last updated: 2026-07-30
Continuous monitoring means FlowConsent re-runs the "consent refused" scan on your pages at a regular interval and alerts you the day a previously compliant page starts leaking. A one-off scan tells you whether the banner is respected today; what actually protects you is knowing **when that changes** — a tag added by a marketing team, a site-builder setting re-enabled. Regressions never announce themselves.

## The refusal scan, on demand

From a banner's **Compliance** tab, "Verify now" loads the page in a real browser, refuses consent (or, when no reject button is found, interacts with nothing), then records everything that still runs: requests to tracker domains, tracker signatures in the page, non-essential cookies and local storage — including on a second navigation, where a badly stored choice typically leaks.

The scan watches from **Europe**: browser sessions run in `eu-central-1`, so your site sees an EU visitor and serves exactly what an EU visitor gets.

Three profiles trade speed for depth:

- **fast** — quick pass, ~30 s budget per page;
- **deep** — the default, ~70 s: full observation window;
- **ultra** — ~190 s, for slow or heavy pages that time out in deep.

Verdicts are **Compliant** (nothing leaked), **Warnings** (non-essential cookies but no trackers), or **Violations** (trackers ran despite refusal). Google Consent Mode cookieless pings (`gcs=G100`) are conformant with a refusal and are never counted as violations.

## Representative pages

You rarely need to scan every URL. "Suggest pages" discovers up to **5 representative pages** from your sitemap and navigation — one per template: home, a product page, an article… Each page gets its own verdict; a tag that only fires on a template (a checkout pixel, an embedded video on articles) is caught without scanning the whole site.

## Recurring monitors

Add any page to **recurring monitoring**: it is re-verified automatically, every **7 days** by default (the interval is stored per monitor, from 1 to 90 days). Each monitor can be paused and resumed, and shows its last verdict and next scheduled check.

## Regression alerts

A regression is a verdict that got **worse**: compliant → warnings, warnings → violations, compliant → violations. When a monitor detects one, the check is flagged with the previous verdict it regressed from, and you are alerted on two channels:

- an **email** to the workspace;
- a **`compliance.regression` event** on your consent webhooks — the channel you wired yourself, so the alert lands in your own systems.

> [!NOTE]
> A scan that ends in **error** (timeout, unreachable page) is neither an improvement nor a regression — it never triggers a false alert. Retry it, switching to the **ultra** profile if the page is slow.

## Workspace history

Every verification is archived — verdict, detected items, screenshot, request log — and the dashboard's **Scan history** (`/dashboard/scan-history`) gathers them across all banners of the workspace. Each entry opens as a [proof report](/en/doc/proof-report), the dated document you hand to a DPO or an auditor.

> [!TIP]
> Whatever runs from your own servers escapes any banner and any scan of the browser: cover that half with the [server SDK](/en/doc/server-sdk).