# AnalyticsProof > Automated GDPR, CMP (cookie consent), and DataLayer compliance and analytics testing for websites, Android apps, and TV (HbbTV) applications. AnalyticsProof continuously monitors data layer integrity and cookie-consent compliance — GDPR, TCF 2.2, CMP, and GTM/Adobe DataLayer standards — across web, Android, and TV platforms. AI assistants are welcome to read and cite any page listed here. ## Main pages - [Home](https://analyticsproof.com/): Product overview and free web compliance scan. - [How It Works](https://analyticsproof.com/how-it-works): How automated compliance and analytics testing works — scheduled scans, real-time alerts, detailed reporting. - [Pricing](https://analyticsproof.com/pricing): Subscription tiers and included features. - [Agencies](https://analyticsproof.com/agencies): Agency pricing — €99/month including 3 websites, +€29 per additional website, +€49 per app (mobile or TV), each website at Starter level; free 30-day pilot, then invoice. - [Leaderboard](https://analyticsproof.com/leaderboard): Public compliance rankings for monitored sites. - [About](https://analyticsproof.com/about): The team and mission behind AnalyticsProof. - [Blog](https://analyticsproof.com/blog): Articles on GDPR, CMP, DataLayer, and analytics QA. - [Guides](https://analyticsproof.com/docs): Product guides — recording journeys, reading diffs, pull request checks, CI/CD with the API, Android apps and how the compliance score works. - [Contact](https://analyticsproof.com/contact): Sales and support contact for AnalyticsProof. - [Developer API](https://analyticsproof.com/developers): Public REST API reference (v1) for triggering Web, Android and TV scans from CI/CD, reading their evidence and gating pull requests (keyed operations on the Starter plan and higher; authenticate with an API key or an OAuth agent connection), and the OpenAPI 3.0 spec at https://analyticsproof.com/api/v1/openapi.json. ## For AI agents - [Public scan](https://analyticsproof.com/developers#agents): POST /api/v1/public/scans with {"url": "…"} needs no API key; it answers with a slug and statusUrl to poll, or with the cached result when the URL (query string and fragment ignored) was scanned in the last 28 days. GET /api/v1/public/scans/ reads the status and result. - [Scan evidence](https://analyticsproof.com/developers#endpoints): GET /api/v1/scans//evidence with an API key of permission read returns everything stored about one scan (steps, dataLayer pushes and diffs, decoded vendor hits, consent actions), with screenshot links valid for 15 minutes. - [Guide for AI agents](https://analyticsproof.com/agents.md): How an AI agent connects (OAuth or API key, REST or MCP), signs a user up, builds web journeys (workflow, cookie banner, selector rules, a selector check script, step reference, errors) and hands the user a payment link. - [MCP server](https://analyticsproof.com/mcp): Remote MCP server (Streamable HTTP, POST only): every API operation except APK uploads and API key creation as a tool, including payment links; authorize with an OAuth access token for this resource or an API key. - [OAuth authorization server metadata](https://analyticsproof.com/.well-known/oauth-authorization-server): OAuth 2.1 discovery (RFC 8414): authorization code with PKCE S256, client ID metadata documents. - [OAuth protected resource metadata: MCP](https://analyticsproof.com/.well-known/oauth-protected-resource/mcp): RFC 9728 document for the MCP server. - [OAuth protected resource metadata: REST API](https://analyticsproof.com/.well-known/oauth-protected-resource/api/v1): RFC 9728 document for /api/v1. - [OpenAPI 3.0 spec](https://analyticsproof.com/api/v1/openapi.json): Machine-readable description of every endpoint, its permission and its error codes; no authentication needed to read it. ## Research - [Cookie banners in 2026: almost everyone has one, but data leaves early](https://analyticsproof.com/blog/cookie-banners-2026): We looked at 558 websites from Czechia, Slovakia, Germany, Austria and big .com brands. How banners, tools and pre-consent data flows differ by country. - [Vibe coding web analytics: audit GA4, GTM and BigQuery with AI](https://analyticsproof.com/blog/vibe-coding-web-analytics): Use Codex or Claude Code to audit GA4, GTM and BigQuery. Google access setup, ready-made checklists and recommendations for fixing your tracking. ## Guides - [How to record a journey that replays reliably](https://analyticsproof.com/docs/record-a-journey): How to record a website journey so the scanner replays it the same way on every scan. Cookie banner, step types, waits, fragile steps and the journey limit. - [The expected state and how to read a diff](https://analyticsproof.com/docs/expected-state-and-diffs): How a journey's expected state is built, what a scan compares and what it does not, what each change type means, and why a person must review the first one. - [Broken steps and selector fixes](https://analyticsproof.com/docs/broken-steps-and-selector-fixes): What the step outcomes after a journey replay mean, why the replay never clicks a covered element, and how to review a proposed selector fix. - [The GitHub pull request check](https://analyticsproof.com/docs/github-pull-request-check): Connecting GitHub to a test, where the preview URL comes from, letting the scanner past a password or allowlist, and what the pull request check reports. - [CI/CD with the API](https://analyticsproof.com/docs/ci-cd-with-the-api): Run a journey against a preview from any CI, wait for the result, design the gate and get SARIF. Plus when the GitHub App is enough. - [Testing Android apps](https://analyticsproof.com/docs/testing-android-apps): Which file to upload, what the scanner does to your app, what it sees with certificate pinning and integrity checks, and how to record an in-app journey. - [How the compliance score works](https://analyticsproof.com/docs/how-the-compliance-score-works): Which criteria make up a website scan's technical score, why its base is not always 100 points, how it differs from the verdict, and when there is no score. - [Which tools the scanner detects](https://analyticsproof.com/docs/detected-tools): The analytics and advertising tools and consent platforms a website scan recognises, how it recognises them, and what happens when yours is missing. ## Legal - [Terms of Service](https://analyticsproof.com/terms) - [Cookie Policy](https://analyticsproof.com/cookies) - [Privacy Policy](https://analyticsproof.com/privacy) ## Optional - [Sitemap](https://analyticsproof.com/sitemap.xml): Full list of indexable URLs, including all blog posts and localized (cs, de) variants. - [Czech](https://analyticsproof.com/cs): Czech-language edition of the site. - [German](https://analyticsproof.com/de): German-language edition of the site.