Why it matters
In the UK and the EU you need consent before you store or read anything on a visitor's device that isn't strictly needed for what they asked for. Analytics, ad pixels and session recording are not strictly needed. A banner that appears while the trackers have already fired is decoration. This is the problem regulators find first, because anyone can see it in their browser's network tab.
How Patch checks
We load your homepage in a fresh browser with no cookies, wait for the network to go quiet plus three seconds, and record every request, cookie and storage key. We match them against a list of known services and flag the ones that need consent but loaded anyway. We do this from each region separately, because many sites only show a banner to some countries.
How to fix it
- Block the trackers Patch found until the visitor clicks Accept. Most consent tools can do this for you if the scripts are loaded through the tool rather than straight in your HTML.
- If you use Google tags, turn on Consent Mode with every storage type set to "denied" by default.
- Check the result: open your site in a private window, open the network tab, and confirm none of their domains appear before you click Accept.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Applies to visitors in the UK and the EU. Since February 2026 UK law lets purely statistical analytics run without consent if you explain it and offer an opt-out, but advertising, session recording and tools that use the data for their own purposes, such as Google Analytics, still need consent. Quebec requires profiling technology to be off by default. Most US states use opt-out instead of opt-in.