Add Pre-Audit Actions to an Audit

Overview

Pre-Audit Actions are steps an Audit runs once, before it visits any page, including the starting URLs. They're most often used to:

Set a consent state, such as accepting or rejecting all cookies on your consent banner.
Log in so the Audit can scan pages behind a login.

Pre-Audit Actions work the same way as Actions in Journeys. If you plan to reuse the same steps in several Audits, save them as an Action Set. You can save your current steps as a new Action Set, or add an existing one by adding a step with the Action Set action type.

Why Use Pre-Audit Actions

By default, an Audit visits your site as a brand-new visitor: not logged in and no preference chosen from any consent banner. Pre-Audit Actions let the Audit act like a specific type of visitor instead, so you can see what that visitor would experience.

Check that your site respects privacy choices. Set a consent state, such as Accept All or Reject All, and confirm that only the tags and cookies allowed in that state load. This helps you find tracking that fires without permission before it becomes a compliance issue.
Confirm allowed tags still load. When a visitor accepts cookies, tags like Google Analytics should fire. Testing Accept All, or a specific category, shows whether your CMP is blocking tags it shouldn't, which would leave gaps in your data.
Scan pages behind a login. Log in first so the Audit can reach account areas, member content, or other protected pages that a standard Audit can't see.

Add Pre-Audit Actions

Create a new Audit, or open an existing one to edit it.
Fill in the starting URLs and other settings.
Open the Pre-Audit Actions tab.
Add your action steps. See the sections below for consent and login examples.
Save the Audit.

Available Action Types

Pre-Audit Actions use the same action types as Journeys. Each step runs in the order listed.

Action type	What it does
Navigate To	Opens the page in the URL field. Use this as the first step for any custom setup.
Click	Clicks a link or button. Enter the element's ID, Name, XPath, or CSS selector in the Identifier field.
Input	Types text into a field, such as a username. Enter the field's identifier and the text to type.
Masked Input	Works like Input but stores the value encrypted. Use it for passwords and other sensitive text.
Select	Chooses an item from a dropdown list. Enter the list's identifier and the item's value.
Check/Uncheck	Selects or clears a checkbox or radio button.
Execute	Runs custom JavaScript, such as a call to your CMP to set specific consent categories.
Watch	Waits on the page for the number of seconds in the Value field before moving to the next step.
Clear all Cookies	Removes all cookies from the browser up to that point, then moves to the next step.
Switch to iFrame / Leave iFrame	Moves into an iFrame so you can interact with elements inside it, then back out to the main page.
Action Set	Adds a saved set of steps from your Action Set library. See Action Sets.
Consent Manager State (CMP) - Accept All/Reject All	Accepts or rejects all consent on a supported CMP. See the next section.

Set a Consent State

The steps you need depend on how your site's consent banner is built. Choose the option below that matches your site:

1. If your site uses a CMP that ObservePoint supports, such as OneTrust, TrustArc, or Cookiebot, ObservePoint handles the consent banner for you, so you don't need to find any selectors.

Go to the Pre-Audit Actions tab and add a new action.
Choose the Consent Manager State (CMP) action type, then select Accept All or Reject All.
Enter the URL of a page that shows your consent banner.
Save the Audit.

Note: Add the CMP action as the first Pre-Audit Action. Before the Audit starts, ObservePoint opens the URL, clears cookies, and applies the consent choice you selected.

To check whether your CMP is supported, see Automated CMP States.

2. If your banner is not managed by a supported CMP, add the steps manually:

Add a Navigate To action with the URL of a page where your banner appears.
Add a Clear all Cookies action, so no saved consent choice affects the test.
Add a Click action that targets the button that accepts or rejects cookies, using a selector such as #accept-all. See Using XPaths and CSS Selectors for help finding selectors.
Save the Audit.

Note: Some consent banners load inside an iFrame. If the Click action can't find your button, add a Switch to iFrame action before it.

For an example that opens cookie preferences and turns off individual categories, see Validating Consent Managers.

3. To test a specific mix of categories in OneTrust (for example, analytics on but advertising off), follow the steps in OneTrust for Custom Consent States.

Audit different consent states

A consent state is the choice a visitor makes on your consent banner, such as accepting all cookies, rejecting them, or choosing specific categories. Privacy laws like GDPR and CCPA expect your site to honor that choice, so each state needs to be tested.

Privacy Consent States

Each consent state represents a different type of visitor. Here's what each one simulates and what your results should show:

Consent state	What it simulates	What you should see
No choice made	A visitor who hasn't responded to your consent banner yet	In Europe, only strictly necessary tags and cookies. In California, tags can load, but wiretap-risk tools such as session replay and chat should wait for consent
Accept All	A visitor who allows all cookies	All approved tags load, including analytics and marketing
Reject All	A visitor who declines all non-essential cookies	Only strictly necessary tags and cookies
Global Privacy Control (GPC)	A visitor whose browser sends an automatic opt-out signal	Only strictly necessary tags and cookies, the same as Reject All.
Custom categories	A visitor who allows only some categories, such as Performance	Only tags in the allowed categories

Each Audit runs with one consent state. To compare how your site behaves across states, create one Audit per state, keeping the starting URLs and location the same so the results are comparable.

To test visitors in different regions (for example, GDPR in Europe and CCPA in California), set the Audit's location to match and repeat the states that apply there. Location is a separate Audit setting, not a Pre-Audit Action, so you can combine any location with any consent state.

Connect to Compliance Frameworks

ObservePoint's Compliance Frameworks explain which consent states to test for each regulation and what to look for in the results:

Consent state	Related framework article
No choice made	GDPR: No non-essential tags fire prior to consent
No choice made	CIPA: Wiretap-risk tags suppressed prior to affirmative consent
Reject All	GDPR: Non-essential tags stop firing after explicit opt out
Reject All	CCPA: Non-essential tags cease firing after opt out
GPC	CCPA: Global Privacy Control (GPC) is recognized

For the full list of checks, see the GDPR, CCPA, and CIPA Compliance Frameworks.

For a full planning example, see Does my CMP effectively block/allow specific cookies and tags for all possible user-specified consent preferences?

Log in before the Audit

Logins vary (forms, two-factor authentication, VPNs, and more), so the steps depend on your site. Start with a Navigate To action pointing to your login page, then add the steps a visitor would take.

Example: username and password form

Step	Action type	Text Value	Selector Value
1. Go to the login page	Navigate To	`http://jpstyle.us/user/login`	—
2. Enter the username	Input	`student`	`edit-name`
3. Enter the password	Masked Input	`trainme`	`edit-pass`
4. Submit the form	Click	—	`edit-submit`

Note: Masked Input values are stored with industry-standard AES encryption, so no one can view them, including ObservePoint employees.

A few things to keep in mind

Start with Navigate To. Steps such as Click need a page to act on. The CMP action doesn’t need one, because it opens its own URL.
Check that your actions worked. After a run, open it and check Pre-Audit Actions and Pre-Audit Action Failure under Run Properties. If a required action fails, the Completion Status shows Pre-Audit Action Failed, and the Audit may have scanned in the wrong state.
Consent applies per domain. If your Audit covers several domains (for example, example.com and example.co.uk), set consent on each one, or split them into separate Audits so cookies from one domain don't carry over to another.
Set consent before logging in. Consent actions clear cookies, which also ends a login session. If you need both, add the consent steps first and the login steps after.
Leave Block 3rd Party Cookies off in consent Audits. Blocking third-party cookies hides whether your site or the browser stopped a cookie.

Conclusion

Pre-Audit Actions let your Audit start as a specific type of visitor, so you can confirm that your site respects each privacy choice and reach pages behind a login.