Scan a site for cookie consent compliance. Check if cookies are set before consent and categorize by purpose.
A site's homepage loads, its scripts fire, and cookies land in the visitor's browser before anyone has clicked a thing. This scanner automates that first visit: give it a URL and it loads the page without touching the consent banner, records every cookie that appears, and categorizes each one by purpose - strictly necessary, preferences, analytics, or advertising - flagging any that legally needed consent first. The surprise most people hit: a clean report is not proof of compliance. The scanner cannot click through a banner or replay a full human session, so consent-gated cookies can go unseen.
A concrete input and expected output from the current implementation.
Input
https://shop.example.com
Expected output
Report for https://shop.example.com - no consent given, page idle for 10 seconds after load 7 cookies observed: PHPSESSID (session) - strictly necessary - pre-consent: OK cookie_consent (persistent) - strictly necessary - pre-consent: OK _ga (2 years) - analytics - pre-consent: violation _gid (24 hours) - analytics - pre-consent: violation _gat (1 minute) - analytics - pre-consent: violation _fbp (3 months) - advertising - pre-consent: violation _uetsid (30 minutes) - advertising - pre-consent: violation By purpose: 2 strictly necessary, 3 analytics, 2 advertising Set before consent: 5 of 7 (71%); consent required for 5 Verdict: non-compliant - analytics and advertising cookies set before consent
The five cookies whose purpose is not strictly necessary appeared before any consent was given, which Article 5(3) of the ePrivacy Directive permits only for the two exempt cookies: the session identifier and the cookie that records the consent choice itself. The verdict follows directly from the five-to-two split.
The scan loads the target URL in a clean context with no stored cookies for that domain, lets the page and its scripts settle for several seconds, then snapshots every cookie the context can see. Nothing is clicked, so the report reflects the pre-consent state only. A second snapshot catches scripts that write cookies late in page load, so deferred trackers still surface.
Each cookie name is matched against a library of known tracking families - _ga, _gid, and _gat resolve to Google Analytics, _fbp to Meta's pixel, _uetsid to Microsoft's ad tracking - and assigned a purpose category. Names that match nothing are reported as unclassified rather than silently guessed. Only strictly necessary cookies (session handling, security, recording the consent choice) are treated as consent-exempt.
Not necessarily. The scan proves only that no observable cookie appeared during a scripted first visit. Interaction-dependent cookies, cookie writes the scan context cannot execute, and a dirty starting state can all slip through. A clean result is a good sign to investigate further, not a legal clearance.
No. Pre-consent cookie behavior is one technical slice of a bigger picture: the banner itself must obtain valid consent - freely given, specific, informed, unambiguous - and you still need records of consent, a truthful privacy notice, and compliance with national rules implementing the ePrivacy Directive. The scanner checks the pattern, not the paperwork, and it is not legal advice.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.