Skip to main content
Code auditCheck every pull request for privacy riskWebsite auditCatch scripts and vendors that appear in productionInth AgentAsk what changed and follow the answer to its sourceCookie consentFast consent that lives in your codebase
AboutHandbookBlogOSS
AI feature reviewsFundraising Due DiligencePrivacy impact reviewsEnterprise customer reviewsCookie and tracking audits
Pricing
Sign inRun a free scan
Run a free scan
Back to the blog
03 / Article/Runtime

Your consent banner can be correct while your product drifts

A configured banner describes intent. Runtime monitoring shows whether scripts, vendors, and domains actually respect it.

Published
June 24, 2026
Reading time
7 min read
Inth blog
03Runtime

On this page

Contents3 sections
  1. 01Configuration is a claim
  2. 02Watch the boundary after consent
  3. 03Connect runtime back to policy
  1. 01Configuration is a claim
  2. 02Watch the boundary after consent
  3. 03Connect runtime back to policy
Written by
Inth research

Runtime assurance

Consent is not only a user interface. It is a runtime control that has to remain aligned with everything the product loads after a decision.

01 / Section

Configuration is a claim

A consent configuration says which categories and vendors should load for a given region and decision. Production behavior is the test of that claim.

Tag managers, experiments, embedded media, SDK upgrades, and marketing changes can all alter runtime behavior without changing the banner configuration itself.

02 / Section

Watch the boundary after consent

The important boundary is the moment a script, request, or storage operation becomes possible. Monitoring that boundary reveals whether the control held, what destination received data, and which product surface initiated it.

01
Before choice
Only strictly necessary behavior should run.
02
After choice
Allowed categories should match the recorded decision.
03
After change
New vendors and domains should enter review immediately.

03 / Section

Connect runtime back to policy

A new domain is not just a network event. It may change the vendor inventory, data recipients, consent category, transfer analysis, and published policy. The useful signal connects those records instead of creating another isolated alert.

Runtime truth

The product users receive is the system that needs assurance.

Monitor what loads, compare it with consent and policy, then keep the resolution attached to the observed behavior.

Newer article · 02Code review is becoming privacy reviewThe pull request is the last place where a new data flow still has an author, a reason, and enough context to fix it cleanly.Engineering/6 min readOlder article · 04Evidence should ship with the changeThe cheapest evidence is created while the owner, source, review, and fix are already in the same workflow.Assurance/5 min read

Turn the next privacy question into evidence

Connect the product record and give engineering, privacy, security, and legal the same source of truth.

Start for freeTalk to us
Inbox - Inth
Inbox

Open

9 items

Reviewing evidence
  • PII in request logs

    4m

    api-gateway forwards email addresses to the logging vendor.

    P0Code scan·Project finding
  • Script calls new domain

    22m

    cdn.thirdparty.io detected in production before consent.

    P1Website activity·Project finding
  • New tracker: pixel.js

    1h

    Marketing category script added without a vendor record.

    P1Website activity·Project finding
Inbox - Inth
INInthPro
Search⌘ K

Products

Inbox
OpenResolvedDismissedAccepted risk
Agent
Audit
Consent
Billing
Settings
Getting started
Help
AMAlex Morgan

Open

9 items

  • PII in request logs

    4m

    api-gateway forwards email addresses to the logging vendor.

    P0Code scan·Project finding
  • Script calls new domain

    22m

    cdn.thirdparty.io detected in production before consent.

    P1Website activity·Project finding
  • New tracker: pixel.js

    1h

    Marketing category script added without a vendor record.

    P1Website activity·Project finding
  • New SDK: analytics-node@4

    5h

    Adds a data flow to Segment. Policy v9 has no match.

    P2Code scan·Project finding
P0Code scan·Open

PII in request logs

Summary

The API gateway forwards email addresses to a logging vendor without an approved data flow.

Evidence

Open scan report →
src/logging/request.ts:42-44
42
43
44
logger.info({
  email: request.user.email,
});

Recommended action

Remove the email field or replace it with a non-identifying internal user ID.
Inbox item resolved

New agent

Privacy agent

Research privacy requirements and turn guidance into practical next steps.

Ask anything about privacy…
Research

Legal information grounded in curated guidance, not legal advice.

Notes from building privacy into the product

Notes from building Inth. Sent occasionally.

Inth connects what your company promised to what engineers just shipped.

Platform

  • Code audit
  • Website audit
  • Inth Agent
  • Consent banner
  • Pricing

Use Cases

  • Privacy Impact Review
  • AI Feature Reviews

Company

  • About
  • Blog
  • Open source
  • Contact

Resources

  • Documentation
  • GitHub
  • Cookiebench
  • Status

© 2026 Inth. All rights reserved.

  • Contact us
  • Privacy
  • Cookies
  • Terms