What is Baromio-ConsentScan?

The user agent

Every request the scanner makes appends the following to a standard headless Chrome user agent string:

The Chrome version number in the rest of the string changes as we update the browser the scanner runs. The "Baromio-ConsentScan" text is the stable part - match on that substring rather than the full string.

What it does and why

A Baromio customer who monitors your site with a Consent Scan enabled asked Baromio to check which cookies the page sets, once a week, before and after a visitor responds to its cookie banner. Every weekly scan loads the page twice: once to record cookies before any consent action, and once more after the scanner accepts the banner (when one is found) to record cookies afterwards. It reads cookies and page content; it never submits forms, signs in, or stores a cookie's value - only that the cookie exists.

Where it runs from

Consent Scan primarily runs from Baromio's own server infrastructure, with an additional fallback runner on Cloudflare's network for scans the primary runner cannot complete. Because more than one location can produce a scan, and that may change over time, Baromio does not publish a fixed IP address or IP range for it. If your bot protection allows rules based on the request header, allow it by user agent instead of by IP.

How to allow it through your WAF or bot protection

Most bot protection and CDN products, including Cloudflare, let you skip a rule or challenge for requests whose user agent contains a given substring. Add a rule that matches when the user agent contains:

For example, in Cloudflare this is a WAF custom rule with a condition such as "User Agent contains Baromio-ConsentScan" and an action of "Skip" for the managed challenge or bot fight mode. Other WAF and CDN products use similar user-agent allowlist rules under their bot protection settings.