--- title: "See what a site really tracks — before you click Accept" url: "https://consenttheater.org/extension" description: "Free, open-source browser extension for Chrome and Firefox. See trackers, cookies and pre-consent data flows before you click Accept. Reports in 5 languages, HAR sanitizer, no telemetry, no accounts, nothing leaves your browser." --- Browser extension # See what a site really tracks — before you click Accept A free, open-source sidebar for Chrome and Firefox that shows, in plain language, which trackers a site loads, which cookies it drops, and whether any of it happens _before_ you've agreed to a cookie banner. [Install for Chrome / Edge / Brave / Arc](https://chromewebstore.google.com/detail/consenttheater/polanfackgaekglhmgdknmojihbngjkc)[Install for Firefox / Zen](https://addons.mozilla.org/en-US/firefox/addon/consenttheater/)[On Codeberg Build the latest dev version yourself](https://codeberg.org/ConsentTheater/extension) Manual install Install the latest dev build from Codeberg Releases (v0.9.0) Chrome / Edge / Brave / Arc 1. Download [consenttheater-chrome-v0.9.0.zip](https://codeberg.org/ConsentTheater/extension/releases/download/v0.9.0/consenttheater-chrome-v0.9.0.zip) and unzip it somewhere you'll remember. 2. Open `chrome://extensions/`. 3. Turn on **Developer mode** (top-right toggle). 4. Click **Load unpacked** and pick the unzipped folder. Firefox / Zen 1. Download [consenttheater-firefox-v0.9.0.zip](https://codeberg.org/ConsentTheater/extension/releases/download/v0.9.0/consenttheater-firefox-v0.9.0.zip) and unzip it. 2. Open `about:debugging#/runtime/this-firefox`. 3. Click **Load Temporary Add-on…** and pick the `manifest.json` from the unzipped folder. Firefox clears temporary add-ons on restart — reload after each browser restart, or just install the signed build from [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/consenttheater/) instead. All builds and changelogs: [Codeberg Releases](https://codeberg.org/ConsentTheater/extension/releases). What's new ## Version 0.9.0 — Playbill 0.9.0, pretty value output, stable HAR exports - **Updated Playbill catalogue to 0.9.0.** The tracker database grew to **4,123 cookies / 6,312 domains / 3,150 companies** (10,435 merged signatures) — 199 new entries from six contributor PRs. The consent category nearly doubled: new CMPs include CCM19, Clickio, CookieHub, CookiePal, Enzuzo, Gravito, Truendo, Iubenda, Pandectes, and OneTrust and Cookiebot EU endpoints, plus Nordic and EU SaaS hosts, session replay (Lucky Orange, Plerdy, TWIPLA), and Tracklution server-side tagging. With thanks to Pasi R. (Codeberg @PasiRuo) for six verified PRs. - **Pretty Value Output.** Cookie and storage values that are stringified or percent-encoded JSON, or key=value payloads, now render pretty-printed in the sidebar — read what's actually stored instead of URL-encoded mush. On by default, with a per-value raw/pretty toggle; exports are untouched. - **HAR exports survive service-worker restarts.** Chrome kills the idle background worker after ~30 seconds, which used to wipe the captured HAR and make the export claim no scan had run. The finished log is now kept in memory-only session storage and served from there after a restart. - **Report stats now count unique hosts** instead of raw network events — the summary, tables, badge, and text export finally agree. The percent-encoding blind spot in identifier detection is fixed too. Full release notes: [CHANGELOG.md](https://codeberg.org/ConsentTheater/extension/src/branch/main/CHANGELOG.md) on Codeberg. ## What it does ### One-click clean-slate scan Wipes cookies, localStorage, sessionStorage, IndexedDB, cache and service workers for the origin, then reloads. Every scan starts from a true first visit. ### Catches pre-consent tracking The most common GDPR problem is trackers that fire before you accept. ConsentTheater watches from the first byte and flags everything that sneaks in early. ### Understands the banner Finds Accept / Reject / Manage buttons across the top frame, shadow DOM and iframes, then times the scan around your click — so "before you agreed" really means before you agreed. ### Live third-party inspector Always-on view of every cookie, every storage key, and every third-party host the current page contacts, bucketed by tracker company and consent burden. ### Observations, not verdicts We don't grade your site. Each finding is a factual observation — a request, a cookie, a banner shape — tagged with its consent burden under GDPR. Whether the site is compliant overall is a question for a DPA or your DPO. ### PDF & HAR export One click saves a print-ready PDF report or a HAR 1.2 network trace of the entire scan. The HAR opens in DevTools, Charles or HTTPToolkit and carries Playbill classifications inline. A built-in sanitizer redacts cookies and tokens by default — turn it off for raw audit exports. ### Reports in 5 languages The PDF report page includes a language dropdown — English, Spanish, French, German, Italian. Pick a language and the entire report re-renders instantly, ready to share with non-English-speaking colleagues, DPOs, or regulators. ### Shareable report Copy a clean text summary, hand it to a friend, a support team, or (if you go that far) a regulator. ## Screenshots ![Welcome screen in light mode explaining what ConsentTheater does before the first scan](/_astro/screenshot-light-welcome.CCgIh6hp_1wSdWx.webp) Light — welcome & consent ![Welcome screen in dark mode explaining what ConsentTheater does before the first scan](/_astro/screenshot-dark-welcome.DOXC0sV5_1xMKSH.webp) Dark — welcome & consent ![Live scan in light mode — banner shape, pre-consent tracker list grouped by company](/_astro/screenshot-light-scan.DnBnJn4-_1XHxWV.webp) Light — live scan ![Live scan in dark mode — banner shape, pre-consent tracker list grouped by company](/_astro/screenshot-dark-scan.BxImI_3L_Z1BwMY7.webp) Dark — live scan ## Why does it ask for so many permissions? A privacy auditor has to be able to see what a website is doing — so a few browser permissions are unavoidable. Every single one is narrowly scoped and only used for the scan you explicitly trigger. cookies, browsingData To read the origin's cookies and wipe them before the scan, so we measure what a real first visitor sees. webRequest, webNavigation To catch every third-party request during the scan, especially the ones that happen before you touch the banner. content script A static content script registered in the manifest detects the consent banner and resolves your Accept / Reject click. No dynamic script injection — the `scripting` permission was removed in v0.2.0. storage To remember your UI preferences (theme, high-contrast, HAR sanitizer toggle). Nothing else is stored. Required so the above APIs work on whichever site you choose to scan. Your normal browsing is never observed. Full breakdown in the [extension privacy policy](/extension/privacy/). ## Open source, end to end The extension, the tracker catalogue, and this website are all open source under [AGPL-3.0-or-later](/license/). You can read the code, build your own copy, audit every privacy claim, or fork the project. - Extension source — [codeberg.org/ConsentTheater/extension](https://codeberg.org/ConsentTheater/extension) - Tracker catalogue — [codeberg.org/ConsentTheater/playbill](https://codeberg.org/ConsentTheater/playbill) - This website — [codeberg.org/ConsentTheater/website](https://codeberg.org/ConsentTheater/website) HAR exports Got a HAR file from the extension or DevTools? Open it in our [HAR Analyzer](/har-analyzer/) — 100% client-side, no upload. [Open HAR Analyzer](/har-analyzer/) Questions, corrections, or an actor the extension classified incorrectly? Open an issue on [Codeberg](https://codeberg.org/ConsentTheater/extension/issues) — or, if you'd rather, email [developer@consenttheater.org](mailto:developer@consenttheater.org). ConsentTheater is an independent open-source project and is not affiliated with, endorsed by, or sponsored by Google, Mozilla, Microsoft, Brave Software, The Browser Company, Zen Browser, or any other browser vendor. The Chrome Web Store and Firefox Add-ons listings are simply the standard ways to distribute browser extensions. All product names, logos and browser brands are property of their respective owners.