Cookie scanner: see what tracks visitors before they click Accept

25 well-known analytics, advertising and session-replay trackers, including Google Analytics, Google Ads, the Meta Pixel, Hotjar, Microsoft Clarity, the TikTok Pixel and LinkedIn Insight, matched by the requests they make. Cookies from anything it does not recognise are still listed and classified by name, lifetime and first or third party, so nothing the page sets is left out.

No, each scan covers one page, as a regulator's first visit does. Scan your home page first, then each template that loads its own tags, such as product, checkout, contact or blog pages with embedded video or maps. Every scan gets its own shareable report link, so you can compare pages side by side and send the results to whoever manages your tag setup.

A cookie that recognises a visitor across visits or sites for analytics or advertising, such as _ga from Google Analytics or _fbp from the Meta Pixel. Cookies strictly needed for the site to work, such as a login session, a shopping cart or the consent choice itself, need no consent under the ePrivacy rules. The scanner flags trackers that load before the visitor answers the banner.

Yes, but you see what a visitor in Germany gets, because the scanner visits from Frankfurt. Sites that show a banner only to EU visitors, or change it by region, can look different to visitors elsewhere. For a site that geotargets its banner, this scan shows the EU version, which is usually the strictest one and the one regulators check.

Only inside its own throwaway browser session, which is discarded after the scan. It finds the accept button by the selectors of 18 consent platforms or a visible accept button in 20 languages, clicks it and records what appears. Nothing is stored about you or your visitors, and the click never reaches a real user.

Banners inside iframes, shown after a delay of more than a few seconds or with unusual button labels can be missed. The result then shows the pre-consent state only, which is still the important half: whatever loads before the click is what a regulator looks at first. Write to us with the URL and we add the pattern.

Because a banner is not compliance; the tags have to wait for it. Many sites show a banner and still set _ga and _fbp before anyone touches it, because the tag manager fires on page load. The scan reproduces what a regulator sees: a fresh browser, the page, the banner. If a tracker loads at that moment, the result names it, so the fix is a tag configuration change.