--- title: "See what a site really tracks — before you click Accept" url: "https://consenttheater.org/extension" description: "Free, open-source browser extension for Chrome and Firefox. See trackers, cookies and pre-consent data flows before you click Accept. Reports in 5 languages, HAR sanitizer, no telemetry, no accounts, nothing leaves your browser." --- Browser extension # See what a site really tracks — before you click Accept A free, open-source sidebar for Chrome and Firefox that shows, in plain language, which trackers a site loads, which cookies it drops, and whether any of it happens _before_ you've agreed to a cookie banner. [ Install for Chrome / Edge / Brave / Arc ](https://chromewebstore.google.com/detail/consenttheater/polanfackgaekglhmgdknmojihbngjkc)[ Install for Firefox / Zen ](https://addons.mozilla.org/en-US/firefox/addon/consenttheater/)[ On Codeberg Build the latest dev version yourself ](https://codeberg.org/ConsentTheater/extension) Manual install Install the latest dev build from Codeberg Releases (v0.7.0) Chrome / Edge / Brave / Arc 1. Download [consenttheater-chrome-v0.7.0.zip](https://codeberg.org/ConsentTheater/extension/releases/download/v0.7.0/consenttheater-chrome-v0.7.0.zip) and unzip it somewhere you'll remember. 2. Open `chrome://extensions/`. 3. Turn on **Developer mode** (top-right toggle). 4. Click **Load unpacked** and pick the unzipped folder. Firefox / Zen 1. Download [consenttheater-firefox-v0.7.0.zip](https://codeberg.org/ConsentTheater/extension/releases/download/v0.7.0/consenttheater-firefox-v0.7.0.zip) and unzip it. 2. Open `about:debugging#/runtime/this-firefox`. 3. Click **Load Temporary Add-on…** and pick the `manifest.json` from the unzipped folder. Firefox clears temporary add-ons on restart — reload after each browser restart, or just install the signed build from [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/consenttheater/) instead. All builds and changelogs: [Codeberg Releases](https://codeberg.org/ConsentTheater/extension/releases). What's new ## Version 0.7.0 — Playbill 0.7.0, dependency refresh - **Updated Playbill catalogue to 0.7.0.** The tracker database grew to **4,208 cookies / 6,391 domains / 3,003 companies** (10,599 merged signatures). New consent cookies: SureCookie session identifier (`surecookie_session_id`) and WebToffee GDPR Cookie Consent state (`wt_consent`), plus Zest CMP per-category consent state (`zest_consent`) and a new consent domain (`geo.cookiezest.com`). - **Record counts read from the installed catalogue.** Settings and every export format now pull their counts from the installed Playbill at runtime, so they update automatically with future catalogue releases. - **Dependency refresh.** All dependencies are current — including vite, eslint, @types/node and sharp. TypeScript intentionally held at 6.x. Full release notes: [CHANGELOG.md](https://codeberg.org/ConsentTheater/extension/src/branch/main/CHANGELOG.md) on Codeberg. ## What it does ### One-click clean-slate scan Wipes cookies, localStorage, sessionStorage, IndexedDB, cache and service workers for the origin, then reloads. Every scan starts from a true first visit. ### Catches pre-consent tracking The most common GDPR problem is trackers that fire before you accept. ConsentTheater watches from the first byte and flags everything that sneaks in early. ### Understands the banner Finds Accept / Reject / Manage buttons across the top frame, shadow DOM and iframes, then times the scan around your click — so "before you agreed" really means before you agreed. ### Live third-party inspector Always-on view of every cookie, every storage key, and every third-party host the current page contacts, bucketed by tracker company and consent burden. ### Observations, not verdicts We don't grade your site. Each finding is a factual observation — a request, a cookie, a banner shape — tagged with its consent burden under GDPR. Whether the site is compliant overall is a question for a DPA or your DPO. ### PDF & HAR export One click saves a print-ready PDF report or a HAR 1.2 network trace of the entire scan. The HAR opens in DevTools, Charles or HTTPToolkit and carries Playbill classifications inline. A built-in sanitizer redacts cookies and tokens by default — turn it off for raw audit exports. ### Reports in 5 languages The PDF report page includes a language dropdown — English, Spanish, French, German, Italian. Pick a language and the entire report re-renders instantly, ready to share with non-English-speaking colleagues, DPOs, or regulators. ### Shareable report Copy a clean text summary, hand it to a friend, a support team, or (if you go that far) a regulator. ## Screenshots ![Welcome screen in light mode explaining what ConsentTheater does before the first scan](/_astro/screenshot-light-welcome.CCgIh6hp_1wSdWx.webp) Light — welcome & consent ![Welcome screen in dark mode explaining what ConsentTheater does before the first scan](/_astro/screenshot-dark-welcome.DOXC0sV5_1xMKSH.webp) Dark — welcome & consent ![Live scan in light mode — banner shape, pre-consent tracker list grouped by company](/_astro/screenshot-light-scan.DnBnJn4-_1XHxWV.webp) Light — live scan ![Live scan in dark mode — banner shape, pre-consent tracker list grouped by company](/_astro/screenshot-dark-scan.BxImI_3L_Z1BwMY7.webp) Dark — live scan ## Why does it ask for so many permissions? A privacy auditor has to be able to see what a website is doing — so a few browser permissions are unavoidable. Every single one is narrowly scoped and only used for the scan you explicitly trigger. cookies, browsingData To read the origin's cookies and wipe them before the scan, so we measure what a real first visitor sees. webRequest, webNavigation To catch every third-party request during the scan, especially the ones that happen before you touch the banner. content script A static content script registered in the manifest detects the consent banner and resolves your Accept / Reject click. No dynamic script injection — the `scripting` permission was removed in v0.2.0. storage To remember your UI preferences (theme, high-contrast, HAR sanitizer toggle). Nothing else is stored. Required so the above APIs work on whichever site you choose to scan. Your normal browsing is never observed. Full breakdown in the [extension privacy policy](/extension/privacy/). ## Open source, end to end The extension, the tracker catalogue, and this website are all open source under [AGPL-3.0-or-later](/license/). You can read the code, build your own copy, audit every privacy claim, or fork the project. - Extension source — [codeberg.org/ConsentTheater/extension](https://codeberg.org/ConsentTheater/extension) - Tracker catalogue — [codeberg.org/ConsentTheater/playbill](https://codeberg.org/ConsentTheater/playbill) - This website — [codeberg.org/ConsentTheater/website](https://codeberg.org/ConsentTheater/website) HAR exports Got a HAR file from the extension or DevTools? Open it in our [HAR Analyzer](/har-analyzer/) — 100% client-side, no upload. [Open HAR Analyzer](/har-analyzer/) Questions, corrections, or an actor the extension classified incorrectly? Open an issue on [Codeberg](https://codeberg.org/ConsentTheater/extension/issues) — or, if you'd rather, email [developer@consenttheater.org](mailto:developer@consenttheater.org). ConsentTheater is an independent open-source project and is not affiliated with, endorsed by, or sponsored by Google, Mozilla, Microsoft, Brave Software, The Browser Company, Zen Browser, or any other browser vendor. The Chrome Web Store and Firefox Add-ons listings are simply the standard ways to distribute browser extensions. All product names, logos and browser brands are property of their respective owners.