You mostly cannot, after the fact. A website only ever shows you its current state, and the question everyone eventually asks — what was firing on our site last March — is answerable only from evidence captured while March was happening. The realistic goal is to salvage what partial records exist, and to make sure the next twelve months are documented.
The short answer
This becomes urgent in exactly three situations: a demand letter alleges a visit on a specific date, a customer or partner asks for evidence during a security review, or you fixed something and want to show when. In all three, the useful artifact is the same — a dated record of which third-party domains your site contacted, and whether that happened before or after the consent interaction.
The honest framing: nobody can prove a negative about a past website state from today's page. What you can build is a contemporaneous record going forward, plus a reasonable reconstruction of the past from the fragments most sites already have.
Your homepage today reflects today's tags, today's plugin versions, today's container version, and today's CMP configuration. Every one of those changed at least once since the date in question, usually without a deploy and usually without a note. Even a perfect scan run right now tells you nothing about a Tuesday in March.
Meanwhile the other side of any dispute may have exactly what you lack: an automated scan of your site captured on the date they care about. That asymmetry is the whole reason dated evidence is worth keeping.
Six sources, in rough order of usefulness. Most sites have three or four of them and have never looked.
What a healthy result looks like: Realistically you reconstruct a timeline of when tags arrived and changed, not a proof of runtime behavior on a specific day. That is still substantially better than "we think it was fine".
A screenshot you took is weaker than a record produced by a system on a schedule, because the schedule is not something you chose after the fact. Automated, periodic capture beats ad-hoc capture for exactly this reason.
The claims in this area are about what was sent to third parties and when. Page source shows what scripts were present; a network log shows what actually contacted whom, in what order, relative to the consent interaction. Keep the second kind.
A single annual audit proves one day. A continuous record proves the shape of the whole year, including the day a tag appeared and the day it was removed — which is what a good-faith story is actually made of.
Evidence in someone's downloads folder is not a record. It needs to live somewhere your successor, your attorney, and your auditor can retrieve it without you.
Claims under California's Invasion of Privacy Act (CIPA), Penal Code § 631, are argued per affected visit, with statutory damages under § 637.2 of up to $5,000 per violation. The consequence for record-keeping is direct: the period during which a tracker was ungated is the period that matters, so evidence of when something started and when it stopped is doing real work.
The consumer-privacy side has its own record-keeping expectations. California's CCPA regulations include a record-keeping section (§ 7101) covering how businesses retain records related to consumer requests, and a section on the methods used to obtain consumer consent (§ 7004). Neither of those is the same as documenting your tracker timing — but a business that keeps one usually finds it easy to keep the other.
And to be precise about limits: a dated scan documents technical behavior on a date. It is not a legal opinion, not a certification, and not proof that anything was or was not lawful.
Terminology bridge
What you are building is contemporaneous evidence — a record created at the time, not reconstructed later. In compliance language the practice is an audit trail or evidence file; the per-visitor version some CMPs keep is a consent record or consent receipt, which answers "did this person agree" rather than "what was our site doing". The thing that makes a one-time audit go stale has a name too: configuration drift. And the reason regulators and counsel like periodic records is that they demonstrate good faith — that you found the problem yourself and fixed it on a date you can name.
Two limits worth stating plainly. First, no tool can retroactively prove what your website did before that tool started watching — anyone promising otherwise is selling reconstruction, not evidence. Second, a scan record documents technical behavior only: which servers were contacted, when, and in what order. It is not a legal opinion on whether that behavior complied with anything, and nothing here is legal advice.
RegSentry loads your site in a real browser, records when each third-party tracker first contacts its server, and flags everything that fires before consent — with the fix for each one. Continuous monitoring re-runs it and emails you when something new appears.
Free real-browser scan
See every pre-consent tracker on your site — free, 30 seconds, no signup.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.