Independent Privacy, AI Compliance & Consent Intelligence

Privacy Compliance You Can Prove. Not Just Configure.

See What 40T Sees

Live discovery scan · public URLs

CTRL-001HIGH

Tracker fired before consentEVIDENCE captured · JURISDICTION EU GDPR

GPC SIGNALCRITICAL

Signal sent, not honoredOBSERVED TRUE · HONORED FALSE · CCPA

AI TRACKERMEDIUM

AI analytics loaded pre-consentCONFIDENCE 98% · EU AI ACT

Built for regulated teams

What 40T answers

The Questions Your Board, Counsel and Regulator Will Ask

Each capability exists to answer one of them with evidence, not opinion.

Is our consent actually honored?Consent & GPC verificationAccept, reject, withdrawal and Global Privacy Control, tested in a real browser on your live site.Available

What fires before consent?Tracker & AI-tracker detectionCookies, pixels, storage and AI analytics, timestamped against the consent moment.Available

Which laws does this break?Jurisdiction mappingEvery finding cited to the statute and control that governs it, across major jurisdictions.Available

Can legal rely on this?Sealed evidenceRequests, storage and timing captured as evidence and sealed with a SHA-256 hash.Available

Are AI agents creating exposure?Agent-aware scanningWhat fires when an AI agent, not a person, uses your site, before any agent action is permitted.Early access

How it works

From Discovery to Defensible Compliance in Three Steps

No access. No agents. No credentials. Just a URL. That is what makes 40T easy for your security team to approve.

STEP 01Automated

Discover

Read-only scan of observable behavior. Tracking activity, third-party calls and consent signals, captured from any public URL.

Real-time browser instrumentation

STEP 02Forensic

Investigate

Forensic-grade examination of every violation: which regulations apply, how serious the exposure is, and exactly what to fix, supported by an immutable evidence chain.

Deterministic regulatory mapping

STEP 03Defensible

Report

Defensible findings with cryptographic integrity, severity rankings, jurisdiction-specific citations and remediation guidance.

SHA-256 cryptographic audit hash

Methodology

How a Verdict Is Reached. In the Open.

Your legal team works from evidence, not opinions. Your engineers work from data, not interpretations. Your board sees posture, not promises.

Behavior, not configuration

Verdicts come from what a real browser observed on your live site, never from what a dashboard says is configured.

Evidence-gated severity

High and critical findings require captured behavioral evidence. No evidence, no high-severity verdict.

Human review for AI-assisted calls

Observations surfaced with AI assistance are flagged for review and never escalated automatically.

Deterministic citations

Each finding maps to a specific statute and control, so the same behavior always gets the same citation.

Our approach is aligned with the principles of ISAE 3000 (Revised) for assurance engagements. 40T provides technical evidence; it does not certify legal compliance.

Read the methodology

Where it applies

Privacy Laws 40T Checks Against, Mapped to the Map

Privacy laws now span U.S. states, the EU, UK, Canada, Brazil, APAC and more. Every finding is cited to the jurisdiction that governs it.

World map highlighting privacy-law jurisdictions 40T covers across North America, Europe, APAC and beyond

U.S. state laws Global jurisdictions

Full matrix for customers

Assurance

What We Map To. How We Hold Ourselves.

Two different lists, kept separate on purpose.

Your findings map to

Frameworks 40T cites

Privacy laws

EU GDPRUK GDPRePrivacyCCPA / CPRAUS state lawsPIPEDALGPDChina PIPL

AI laws & standards

EU AI ActColorado AI ActNIST AI RMF

Live signals

IAB TCFGoogle Consent ModeGlobal Privacy Control

Full coverage matrix

How 40T secures itself

Trust Center

We publish our own security and compliance status exactly as it stands, including what is still in progress.

Early access

AI Agent Compliance

The web is evolving from pages to callable services. 40T is building the compliance layer for every agent interaction.

THE SHIFT

Google’s WebMCP is turning websites into APIs for AI agents. Agents will book flights, file tickets and add to carts, triggering cookies and tracking on every interaction. Today’s consent model was designed for human visitors, with visual banners and click-to-accept, and it doesn’t yet extend to interactions an agent drives instead of a person. Agent-level consent is an emerging gap across the whole ecosystem.

Agent-awareEarly access

Agent-Aware Scanning

Audit what happens when AI agents, not just humans, visit your site. Detect tracking that fires without visual consent prompts, before any agent interaction is permitted.

Detects pre-consent agent activity

GatekeeperIn development

Pre-Action Compliance API

A pre-action consent check for the agentic web: AI agents will be able to call 40T to verify compliance before acting on a site.

Deterministic approve / block decision

Protocol-nativeEarly access

WebMCP Ready

As sites expose structured tools via WebMCP, 40T queries consent APIs directly, moving beyond HTML scraping to structured, verifiable compliance at the protocol level.

Beyond HTML scraping

We’re not just auditing today’s web. We’re building the compliance layer for tomorrow’s, where AI agents interact with millions of sites and every interaction needs verified consent.40T SECURE AI VISION

40T Secure AI reviewing a privacy investigation report

VERIFIED

40T practices what it preaches

We run our own platform against our own scanner, regularly, and publish the result.

View our public scan report

Decision reference library

Behavior Regulators Have Already Penalized

Every case traces back to a specific control 40T monitors, each grounded in a decision regulators have already made. A proven benchmark for what good looks like, and confidence that 40T is already checking for it on your site.

European Union & UK

Scroll →

United States

Scroll →

Design partners

Now Onboarding Design Partners

For privacy teams, agencies and DPO-as-a-service firms who want independent verification in place before the next audit, not after it.

Apply to partner Start with a scan

Work directly with the founderA security architect reviews your findings with you.
Shape agent complianceEarly input on Gatekeeper and WebMCP verification.
First access to monitoringContinuous re-scans as your site changes.

Comparison

Why 40T?

Each approach has a role. 40T is the one built to observe behavior from the outside and keep the evidence.

Capability	Traditional cookie scanner	CMP dashboard	Manual audit	40T Secure AI
External observation	Typical	Configuration-focused	Varies	40T capability
Runtime behavior testing	Varies	Configuration-focused	Manual	40T capability
Consent verification	Varies	Configuration-focused	Manual	40T capability
GPC validation	Varies	Varies	Manual	40T capability
AI tracking detection	Varies	Varies	Manual	40T capability
Jurisdiction mapping	Varies	Typical	Manual	40T capability
Evidence capture	Varies	Varies	Manual	40T capability
Evidence integrity	Varies	Varies	Varies	40T capability
Technical remediation	Varies	Varies	Manual	40T capability
Continuous monitoring	Typical	Typical	Varies	40T capability

“Typical” and “Varies” describe common approaches in each category, not any specific vendor.

Don’t Guess What Your Website Does. Verify It.

Run an independent discovery scan and see your website from the outside.

RUN RISK SCAN BOOK A DEMO

Read-only discovery • Public URLs • No installation