A privacy audit is a photograph. It tells you exactly what your website was doing on the day the auditor looked, which vendor tags fired, which consent signals were honored, which hosts received data. The trouble is that a website is not a photograph. It is a living system that changes every time marketing adds a pixel, a tag manager pushes a new container, or a third-party script silently updates itself. By the time your annual report is signed, the thing it describes may no longer exist.
For DPOs and compliance teams under the GDPR and the ePrivacy rules, that gap between the snapshot and reality is where the real exposure sits. This piece looks at why point-in-time reviews miss consent drift, and what a continuous approach catches that an audit never will.
What a point-in-time review actually measures
An annual or quarterly review is usually a manual exercise. Someone loads the key pages, opens developer tools, checks that the cookie banner blocks non-essential trackers before consent, and compares the observed tags against a record of approved vendors. Done well, it is genuinely useful. It produces evidence, it surfaces obvious breaches, and it satisfies an accountability requirement on paper.
But it measures a single moment. Three assumptions are baked into that moment, and all three tend to fail:
- The pages tested are representative. Campaign landing pages, checkout flows and A/B variants often carry tags the homepage does not.
- Nothing changes until the next review. In practice, tag managers let non-technical teams deploy trackers in minutes, with no ticket and no privacy sign-off.
- Third parties stay put. A vendor you approved for analytics can add advertising features, change subprocessors, or start setting identifiers you never declared, all without touching your codebase.
Consent drift, defined
Consent drift is the slow divergence between the tracking you have declared and consented for, and the tracking that is actually happening in the browser. It rarely arrives as a dramatic breach. It accumulates.
A marketing team adds a remarketing pixel for a two-week push and forgets to remove it. A tag manager container inherits a new vendor through a template update. An embedded video player begins loading a fingerprinting script after a provider-side change. Each event is small. Together they mean that the vendor register in your files and the network calls leaving your users' browsers describe two different websites.
This matters legally, not just operationally. Under the ePrivacy rules as applied across the EU, non-essential trackers require prior consent, and regulators expect that consent to map to what genuinely loads. The French regulator's guidance on cookies and trackers has been explicit that publishers remain responsible for what fires on their pages, including third-party tags, and enforcement has followed that line. See the CNIL on cookies and other tracking devices. Transparency obligations under the GDPR compound the point: you cannot inform users about processing you do not know is occurring, a theme the EDPB develops in its transparency guidelines.
Why continuous scanning catches what audits miss
The core difference is not depth, it is frequency and coverage. A continuous approach reframes compliance from a report you produce once to a state you observe constantly.
The mechanics that make this work:
- Render pages in a real browser. Static scanners read source code, but modern tracking is assembled at runtime by scripts loading other scripts. Only a real render exposes the full chain.
- Capture the entire network waterfall. Every host contacted, every request, every identifier set, not just the tags you thought to look for.
- Match against a declared vendor register. The observed hosts are compared, continuously, against the list of vendors you have actually approved and disclosed.
- Alert on drift. When an undeclared host ships or a tag fires before consent, the deviation is raised as it happens, not months later.
The practical outcome is a shift in when you learn about problems. Instead of discovering an unapproved pixel during next year's audit, after it has processed data for eleven months, you learn about it the day it appears, while remediation is a five-minute conversation rather than a breach assessment.
What this changes for compliance teams
Continuous monitoring does not replace the audit. It changes what the audit is for. Freed from the impossible job of catching every change by hand, periodic reviews can focus on judgment: assessing new vendors, reviewing consent-banner design, and closing process gaps that let unapproved tags reach production in the first place.
It also reshapes the evidence you hold. A single dated report becomes a running log of what loaded, when, and whether it matched your declarations. That is a far stronger accountability position, and a far calmer one, when a regulator asks how you supervise third parties over time.
This is exactly the gap Seqlense GDPR is built to close. It renders your live pages in a real browser, captures the full network waterfall, matches every detected host against your declared vendor register, and raises a drift alert the moment an undeclared tag ships. The point is not to generate more paperwork. It is to move you from describing the past to watching the present.