Free cookie scanner
that shows what fires before consent.
Most cookie checkers list the cookies on your site. This one loads your page twice, with and without consent, and separates the trackers that ran before permission from the ones that waited. The first list is the one a regulator cares about.
Two scans: cookies before consent, and after
A single scan cannot tell a violation from a legitimate tracker, because the same cookie is lawful after consent and unlawful before it. We run your page in two clean browser sessions and compare them.
- Pass one loads with no consent given at all
- Pass two accepts your banner, then reloads
- Anything in pass one ran without permission
- Each finding names the script that set it
Beyond cookies: local storage, beacons and fingerprinting
A checker that only reads cookies reports a clean site while identifiers sit in local storage and pixels phone home on every page load. We capture the parts that leave no cookie behind.
- Cookies with every attribute: Secure, HttpOnly, SameSite, lifetime
- localStorage, sessionStorage and IndexedDB keys
- Third-party requests that set nothing but still disclose your visitor
- Canvas, WebGL, audio and font fingerprinting
Every cookie named, categorised and cited to the law
A list of 180 findings is a spreadsheet nobody reads. We group by the vendor that set them, because that is how the fix works, and cite the provision each one breaches so the person you forward it to knows why it matters.
- Grouped by provider, not one row per cookie
- Names the script that loaded each tracker
- Cites DPDP Section 6, GDPR Article 6 and ePrivacy Article 5(3)
- Tells you what to change, not just what is wrong
What a cookie scan can and cannot tell you
A scanner loads your pages in a real browser and records what happens. That makes it the only honest source for what your site does to a visitor, but it is a snapshot of the pages it visited, at the moment it visited them, and it is worth being clear about the edges.
| What it sees | What it cannot see |
|---|---|
| Cookies written on load, before any interaction | Trackers that only fire after login, or deep in a funnel it cannot reach |
| localStorage, sessionStorage and IndexedDB keys | Server-side tracking that never touches the browser |
| Network beacons and pixel requests, with their destination | What a third party does with the data once it arrives |
| Fingerprinting signals: canvas, font and device enumeration | Tags that only load for certain geographies or A/B variants |
| The difference between the pre-consent and post-consent pass | Whether your consent record is stored correctly on your side |
Why two passes, and why the first one matters more
Most checkers load your site once and list what they find. That tells you your inventory, which you need for a cookie policy, but it does not tell you whether you have a compliance problem.
The obligation across ePrivacy, the GDPR and the DPDP Act is not to disclose trackers. It is to obtain consent before non-essential ones are set. So the question that decides whether you are exposed is narrower than "what cookies do we have": it is "what ran before anyone agreed to anything". The first pass answers exactly that, and everything in it that is not strictly necessary is a finding.
The second pass then shows what your banner actually unlocks. Comparing the two catches the failure mode that is invisible from the front end: a correct-looking banner sitting on top of tags that already fired.
The findings people are most surprised by
- Google Analytics before consent. Almost always because the tag sits in the page head rather than behind the consent gate, and consent mode is either absent or misconfigured
- Embedded video. A single YouTube embed sets advertising cookies on load unless the privacy-enhanced domain is used
- Chat and support widgets. Often loaded by a tag manager, frequently forgotten, and usually categorised as necessary when they are not
- Fonts and CDNs. Not cookies, but they transmit IP addresses to a third party, which several EU supervisory authorities have treated as processing requiring a basis
- Tags nobody remembers adding. A marketing pixel from a campaign that ended two years ago is the single most common orphan we see
What to do with the report
The findings are grouped by severity and cited to the provision they engage, so the list doubles as a work queue. The order that wastes least time is usually:
- Remove what you no longer use. Orphaned tags are the cheapest fix available and need no consent work at all
- Gate the rest behind consent, so nothing non-essential runs in the first pass
- Write the inventory down: the cookie policy generator takes the list and produces the table your policy needs
- Re-scan after the change, because the fix is only real if the first pass comes back clean
If the report shows trackers firing before consent, the underlying problem is that your banner notifies rather than blocks. That is what the consent manager fixes, and it keeps the record proving each choice.
The things people ask us
Is the cookie scanner really free?
Yes. No account, no email address, no trial period. You enter a URL and get the report. There is a rate limit to keep the browsers available for everyone, and the error message tells you when you can scan again.
How is this different from other free cookie checkers?
Most load your site once and list what they find. This one loads it twice, with and without consent, and separates the trackers that ran before permission from the ones that waited. The first list is the one that determines whether you have a compliance problem, and a single-pass scanner cannot produce it.
How long does a scan take?
Usually a minute or two. It runs a real headless browser against your pages rather than parsing HTML, which is slower than a static check and the only way to see what actually executes.
Do I need to verify that I own the site?
No. The scanner only loads your pages the way any visitor would and records what they do. It does not log in, submit forms, or change anything, so no ownership proof is needed.
Does a clean scan mean I am compliant?
It means nothing non-essential fired on the pages scanned, before consent, at that moment. That is a necessary condition, not a sufficient one: it says nothing about whether your consent records are stored properly, whether your notice is adequate, or what happens behind a login.
Which laws are the findings cited against?
Each finding is judged against sixteen regimes: the EU and UK ePrivacy rules and GDPR, India's DPDP Act, Brazil's LGPD, Thailand's PDPA, Quebec's Law 25, South Korea's PIPA, China's PIPL, the Saudi and UAE PDPLs, US state laws such as the CCPA, Canada's PIPEDA, Switzerland, Japan, Singapore, Australia and South Africa. A finding says where it is a breach, where it becomes one (DPDP from 13 May 2027), and where notice or an opt-out is enough, with the provision for each.
Does the scanner test US opt-out rules?
Yes. It reloads the homepage with Global Privacy Control switched on and reports any advertising that still runs, and it checks for a Do Not Sell or Share or Your Privacy Choices link where advertising trackers are present.
From cookie scan to consent banner, in one place.
The consent manager blocks every tracker in that report until your visitor agrees, and writes an append-only record proving they did.