Last reviewed 19 October 2026

Built to find the boxes nobody meant to tick

untick is an independent product built and operated by Mahmoud Shayeb. It tests websites from the outside, as a first-time visitor and as a regulator would, for cookie consent, dark patterns, the withdrawal button and accessibility, and turns what it finds into evidence and fixes that a marketing team, a developer and a lawyer can all read.

Why untick exists

Most companies with a cookie banner believe they’re covered. Then a new pixel goes live with a release, a plugin update changes a checkbox, or the reject button quietly stops working. Nobody notices, because nobody tests the banner the way a visitor meets it.

Regulators do. They open a browser, look at what loads before anyone clicks, press “Reject” and watch what happens. untick does the same, on your schedule, and tells you before they do.

Accessibility works the same way. The ADA and the European Accessibility Act both point at WCAG, and many barriers are things a browser can find: missing alt text, low contrast, a keyboard that gets stuck in the cookie banner. untick checks those on every site scan and says plainly what still needs a person.

What we believe

We practise what we checkNo advertising trackers on our site, a cookie-free visit counter (Cloudflare Web Analytics), one strictly necessary cookie when you sign in, and our own site is part of the scanner’s test suite.Evidence over opinionsEvery finding shows what our browser saw: screenshots, requests, cookies and the exact wording, so you can check our work.Plain words, real sourcesEach check links to the law or the regulator’s own guidance behind it, and says what we can’t know from the outside.Honest about limitsuntick finds risk; it isn’t legal advice, and a clean scan isn’t a certificate. We say so on every report.

Who’s behind it

Hi, I’m Mahmoud Shayeb, a senior software engineer from Palestine and the developer behind untick. I build and run it myself: the scanner, the checks, the reports and the support inbox.

A cookie banner can look right and still get it wrong: a tag that fires before anyone clicks, or a Reject button that quietly stops working after a release. You only see it by testing the site the way a visitor meets it, so that’s what untick does, every time.

Every check links to the law or the guidance behind it. If a finding looks wrong to you, tell me at hello@untick.io. I read every message.

I run untick as an individual, not a registered company. Payments, invoices, tax and refunds are handled by Paddle.com, our Merchant of Record.

I also build truncly, babara and lodariq.

Common questions

Who runs untick?

Mahmoud Shayeb, a senior software engineer from Palestine, builds and runs untick as an individual, not a registered company. Payments, invoices, tax and refunds go through Paddle.com, the Merchant of Record.

What does untick check?

Cookie consent, dark patterns, the EU withdrawal button and accessibility against WCAG 2.2 A and AA. It tests a site from the outside, the way a first-time visitor meets it, and shows the evidence for every finding.

Is a clean untick scan a certificate?

No. untick finds risk and shows the evidence. It isn’t legal advice, and a clean scan isn’t a certificate. Every report says so.