🍪

Cookie & Privacy Scanner

Scan any page for first-party cookies and third-party trackers (analytics, advertising and social pixels), detect whether a consent banner actually blocks them before opt-in, and surface the exact GDPR / ePrivacy / CCPA gaps privacy-focused visitors and regulators look for.

⚡ Interactive demo — sample data

2 tracker(s) appear to fire before consent and no consent banner was detected in this sample.

Cookie PHPSESSID — category: necessary Looks good

Tracker Google Tag Manager (analytics) — loads unconditionally, no gating signal found Issue

Tracker Meta Pixel (marketing) — loads unconditionally, no gating signal found Issue

Consent Consent banner / CMP detected — Not detected Issue

Consent Compliance gap — trackers load on every visit with no opt-in step Issue

This is a sample. Run the real check on your own URL above ↑

About this tool

How it works

Enter your website URL

Paste any public page and run the scan. We fetch the page once (the same way a browser's first request does) and read the cookies your server actually sets in that response, plus every script tag in the returned HTML.

We flag trackers and check consent gating

The scan matches cookies and scripts against a curated list of common analytics and advertising trackers (Google Analytics, Meta Pixel, LinkedIn, TikTok, Hotjar and more), then checks whether each one looks blocked behind a consent tool or whether it would fire on every visit with no opt-in.

Review the gaps and fix them

You get a plain-language list of cookies/trackers found, whether a consent banner was detected at all, and which trackers appear to run before consent — the exact pattern regulators and privacy-focused visitors look for. Re-run after adding or reconfiguring a consent tool to confirm it's actually working.

What we check

First-party cookies set on page load — Reads the Set-Cookie headers returned by your server on the very first request, categorized as strictly necessary, functional, analytics, marketing, or unknown.
Known analytics & advertising trackers — Scans the page HTML for the script signatures of common analytics tools (Google Analytics 4, Universal Analytics, Google Tag Manager, Hotjar, Microsoft Clarity, Matomo, Mixpanel, Amplitude, Segment, HubSpot) and advertising pixels (Meta, Google Ads, Microsoft/Bing Ads, LinkedIn, TikTok, Pinterest, X/Twitter, Snapchat, Criteo, Taboola, Outbrain, Amazon Ads).
Consent-gating status per tracker — Checks whether each detected tracker's script tag looks rewritten/blocked by a consent-management platform (a common technique: swapping the script's type attribute or adding data-category/data-consent attributes) versus loading unconditionally.
Presence of a consent banner / CMP — Looks for known consent-management platforms (OneTrust, Cookiebot, CookieYes, Complianz, Termly, Iubenda, Osano, Didomi, TrustArc, Quantcast Choice, Usercentrics) or a generic 'we use cookies' banner pattern.
Cookie security attributes — Flags first-party cookies missing the Secure, HttpOnly, or SameSite attributes, which are separate from consent but still a basic cookie-hygiene check.
Trackers firing before consent — The core compliance signal: does at least one analytics or marketing tracker appear to run on every page load with no visible opt-in step? That's the pattern most GDPR/ePrivacy and CCPA/CPRA cookie-consent complaints are built on.

Common issues we catch

No consent banner at all — The site runs Google Analytics and/or ad pixels with zero cookie notice. In the EU/UK this is a straightforward ePrivacy Directive and GDPR gap; in California it can trigger CCPA/CPRA 'opt-out of sale/share' obligations once ad pixels are in play.
A banner exists but doesn't actually block anything — A very common misconfiguration: the consent tool is installed and shows a popup, but the underlying analytics/ad scripts were never rewired to wait for consent — they still execute the moment the page loads, banner or not.
Analytics treated as 'no big deal' — Teams often gate ad pixels but leave Google Analytics running unconditionally, assuming analytics doesn't need consent. Under GDPR/ePrivacy, non-essential analytics cookies generally do require opt-in just like ad trackers.
Consent tool installed on staging, never verified in production — We regularly see the CMP script present but pointed at a demo/test configuration, or blocking nothing because the integration step (rewriting tracker `<script>` tags) was skipped when trackers were added later.
Third-party embeds sneaking trackers in — YouTube embeds, social share widgets, and some chat widgets set their own tracking cookies independent of your CMP setup — easy to miss because they don't feel like 'your' analytics or ad tags.
Missing Secure/HttpOnly on session cookies — Not a consent issue, but a basic hardening gap: session or auth cookies without Secure/HttpOnly are more exposed to interception or script-based theft (XSS) than they need to be.

Where this matters

GDPR / ePrivacy Directive (EU & UK) — Both generally require informed opt-in consent before setting non-essential cookies (analytics, advertising) — this scan flags the exact pattern regulators look for: trackers firing with no prior consent step.
CCPA / CPRA (California) — Requires a way to opt out of the 'sale or sharing' of personal information, which most enforcement guidance treats as covering third-party ad pixels like Meta Pixel and Google Ads remarketing tags.
CookieYes, OneTrust, Cookiebot, Complianz, Termly, Iubenda, Osano, Didomi, TrustArc, Quantcast Choice, Usercentrics — The scan recognizes each of these consent-management platforms by their script/cookie signatures, so you can confirm your chosen CMP is actually detected and, more importantly, that it's actually gating your trackers.
WordPress, Shopify, and page builders — Plugin-installed CMPs (Complianz, CookieYes, etc.) are detected the same way as custom implementations — useful for catching a plugin that's active but misconfigured.
Google Analytics / Tag Manager & major ad platforms — Covers the tags most sites actually run: GA4, Universal Analytics (legacy), GTM, Meta Pixel, Google Ads, Microsoft/Bing Ads, LinkedIn, TikTok, Pinterest, X/Twitter, Snapchat, plus common analytics tools like Hotjar, Clarity, Matomo, Mixpanel, Amplitude and Segment.

Frequently asked questions

Does this tool give me a cookie consent banner?

No. This is a scanner, not a consent-management platform — it reports what's already happening on your site (cookies set, trackers detected, whether they're gated) so you know whether you need a CMP or need to fix your existing one. It doesn't inject any banner or block any script itself.

Is this legal advice?

No. It reports technical signals only — what cookies and trackers were observed, and whether they appear to fire before consent. Whether that constitutes a compliance violation, and what you're legally required to do about it, depends on your jurisdiction, audience, and specific setup. Consult qualified counsel for a compliance determination.

Why does it say 'no cookies observed' when I know my site sets cookies?

This scan reads only the Set-Cookie headers returned on a single, unauthenticated page fetch — the same as a first-time visitor's first request. Cookies set later by JavaScript after the page loads, or only after you log in, aren't visible to a single fetch and won't appear here.

My consent banner is installed — why does the scan still say trackers fire before consent?

This is the single most common finding: a CMP is installed and displays a popup, but the analytics/ad scripts underneath were never actually rewired to wait for consent. Check your CMP's script-blocking setup (usually done by changing each tracker's script `type` attribute or wrapping it in the CMP's own loader) rather than just adding the banner.

Does analytics really need a cookie banner, or just ad trackers?

Under GDPR/ePrivacy guidance in most EU member states and the UK, non-essential analytics cookies (including Google Analytics) generally require the same opt-in consent as advertising cookies — 'it's just analytics' is a common but risky assumption. This scan treats analytics and marketing trackers as separate categories so you can see exactly which ones need attention.

What counts as a 'strictly necessary' cookie that doesn't need consent?

Session/login cookies, CSRF tokens, shopping-cart state, load-balancer routing cookies, and the CMP's own consent-choice cookie are generally considered strictly necessary under GDPR/ePrivacy and are exempt from opt-in requirements. This scan categorizes cookies it recognizes into necessary / functional / analytics / marketing / unknown.

Can this tool see trackers added by a tag manager container I haven't published yet, or that load conditionally in JS?

It sees whatever tag manager container script is present in the HTML (e.g. a GTM snippet) and any tracker signatures visible in that fetched HTML. Trackers fired dynamically from inside a tag manager's own internal logic, or added conditionally after complex client-side JavaScript runs, may not all be visible to a single-page fetch.

How is this different from the Analytics & Tracking Detector tool?

The Tracking Detector tells you which analytics/ad tags are installed. This scanner goes a step further into privacy compliance: it checks the actual cookies your server sets, whether a consent banner exists at all, and — critically — whether the trackers it finds are actually gated behind that consent step or firing regardless.

This is one of several free SEO tools from Custom Web Audits. For a complete, prioritized analysis of your whole website, run a full audit.