by Papaya

The Privacy Pentest

Enter a website. We map its real user journeys, test them across major jurisdictions and consent choices, and hand you the evidence in minutes.

Tests start immediately. No setup required.

Trusted by privacy-forward teams

Chicago Booth
Superset
Launch Chapel Hill, powered by KPMG
Sample finding Checkout · California · Reject all

Marketing request continued after rejection

The report links this observation to the exact browser step, request evidence, screenshot, affected journey, and recommended fix.

Coverage includes consent behavior, tracking, Global Privacy Control, and pixel-litigation exposure. The suite adapts its journeys to the website.

Journeys built for your site

The suite adapts to what your site actually does, and tests each journey before consent, after accept, after reject, and under Global Privacy Control.

EcommerceBrowse products, add to cart, and proceed through checkout.
News & publishingOpen and read an article, plus other interactions the site supports.
CorporateBrowse company pages and read a blog post.

Jurisdictions & test profiles

GDPR and CCPA-style requirements, plus pixel-litigation testing. Defaults below; add or remove locations in conversation.

US-CA
California
CCPA/CPRACIPAECPA
US-FL
Florida
FSCAECPA
US-PA
Pennsylvania
WESCAECPA
US-CO
Colorado
Colorado Privacy ActECPA
FR
France
GDPRePrivacy / CNIL
GB
United Kingdom
UK GDPRPECR

Evidence you can hand to counsel

Screenshots & live sessions

See exactly what the browser saw, including the consent banner, at every step.

Trackers & data transmitted

Network traffic, cookies and pixel payloads, before and after each consent choice.

Findings by journey & geography

Suite-level findings with severity, applicable laws and remediation, plus coverage gaps.

Pricing

Your tests start before you pay. Choose a plan while they run.

One-time Privacy Pentest
$1,200
one assessment

A single assessment of the submitted website.

Monthly Privacy Pentest
$1,000
per month

One customer-triggered assessment each billing month, comparison with the prior result, and change notifications.

Questions

What is a privacy pentest?

Browser agents visit your site like real users, make consent choices, and record every tracker, cookie and network request so you can see what data leaves the page and when.

How is this related to pixel litigation?

CIPA and ECPA claims often turn on whether pixels fire and transmit data before or despite consent. We test exactly those conditions, journey by journey.

Do I need to configure tests?

No. We pick journeys for your site and apply default jurisdictions. You can change anything in a conversation before running.

How long does it take?

Most suites finish within minutes. You can watch live or leave your email.

Test your site now