Scan a site for cookies that fire before consent
Enter a URL. Get a scored browser report on what runs before consent, what remains after reject, what fires after accept, and where visitor data goes.
Checks one public URL in a clean headless browser. No signup, nothing stored.
What this checks
Cookies before consent
Cookies present in a clean browser before the visitor makes a consent choice, with known trackers named.
Trackers and data flows
Third-party scripts, pixels, embeds, collect calls, and fonts that run in the browser, plus the vendor and country behind each.
Reject and accept behavior
Whether reject stops tracking after reload and whether accept activates the tags that are configured.
Need the consent setup fixed?
This scan checks the main URL. We run the deeper audit across templates, mobile states, tag rules, revocation, and build the fix into your stack.
Questions about the Cookie Scanner
How does the Cookie Scanner test consent?
It opens the page in a clean headless Chrome three times: once without touching the banner, once after clicking reject and reloading, and once in a fresh profile after clicking accept. Every cookie and every third-party request is recorded per phase, so you see what runs before a choice and what survives a reject.
What do the GDPR and the TDDDG require before a cookie loads?
§ 25 TDDDG requires consent before anything that is not strictly necessary is stored on or read from the visitor's device. The GDPR adds that every tool is named in the privacy policy (Art. 13) and that transfers outside the EU have a legal basis (Art. 44 ff.). The report checks all three for the scanned URL.
How does the scanner find the reject button?
It clicks the reject control of the common consent tools directly, including Cookiebot, OneTrust, and consentmanager. Otherwise it looks for a visible button labelled reject, decline, or ablehnen, and opens the settings layer when reject only appears there. When none exists, the report says so and skips the reject phase.
How does it decide that a cookie is tracking?
Consent, session, and framework cookies count as necessary. Cookies matching our signature list or the Open Cookie Database get that database's category. Any third-party cookie counts as tracking, and an unknown first-party cookie that lives 180 days or longer is flagged for review.
Does one scan prove my site is compliant?
No. It checks one URL in one visit and is technical evidence, not legal advice. Other templates, logged-in states, and consent revocation can behave differently, which is what a full audit covers.
From the blog
- The best free cookie scanners, ranked
A vendor-neutral ranking of the best free cookie scanners: what each one actually checks, which test the consent gate, and which only list cookies.
- 7 cookie consent mistakes that break GDPR
The cookie consent mistakes we find most often on business sites: tracking before consent, fake reject buttons, undisclosed tools, and US transfers.
- Is your cookie banner actually GDPR-compliant?
What the GDPR and the TDDDG require from a cookie banner: consent before tracking, a reject that works, and every tool named in your privacy policy.
