Last updated: 6 August 2026.
Consent Lens is designed to collect nothing and send nothing anywhere.
Consent Lens makes no network requests. There is no analytics, no telemetry, no crash reporting and no remote code. Every file that runs is packaged inside the extension.
It has no host permissions. It cannot read or act on any page unless you click the extension's icon and then click "Scan this page". There are no persistent or auto-running content scripts.
Nothing is sent to the developer or to any third party. There is no backend server.
When you run a scan, the results (page URL, page title, timestamp, detected consent platform and the findings) are stored in the browser's local extension storage on your own device. At most the last 20 scans are kept.
This history is never transmitted anywhere, is only read back by the extension's own popup, and can be cleared at any time with the Clear button. Uninstalling the extension removes it.
The "Export report" feature builds a self-contained HTML file on your device. No data is uploaded to generate it. What you do with the file afterwards (for example emailing it to a client) is outside the extension's control.
activeTab: grants temporary, click-initiated access to the current tab so the scan can run. No access exists before you click.
scripting: runs the one-off scan in the active tab when you click "Scan this page".
storage: keeps your scan history on-device only.
downloads: saves the exported HTML report where you choose.
No other permissions are requested and there are no host permissions, so Consent Lens cannot run in the background on any site.
The scan reads visible page text and styles (for example the wording on accept and reject buttons, and names of cookies present) purely to build the findings shown to you. This includes same-origin child frames of the page, since some consent platforms render their banner in an iframe; a cross-origin consent iframe may be out of reach, in which case the platform is still identified from the top frame. Only cookie names matching a small built-in list of common analytics and marketing prefixes are kept in the findings; the full cookie list is checked against that list but not stored. A separate minimal check reads the IAB Transparency and Consent Framework API, if present, to see whether a consent manager has loaded and whether a consent string exists; it never reads the string's contents, only its length. Everything happens locally in the one-off, click-triggered scan.
Privacy questions: studiomfl@outlook.com