GDPR Cookie Compliance Scanner

Scan any website for GDPR cookie compliance violations in seconds. Privacy audits and consent banner checks are time-consuming when done manually — run bulk scans across client portfolios and get a clear Pass/Warning/Fail grade for each site. Built on a real browser engine to catch JavaScript-set cookies that static scanners miss.

Features

• Pre-consent cookie detection — identifies analytics, marketing, and tracking cookies set before user consent
• Cookie categorization — classifies every cookie as necessary, analytics, marketing, functional, or unknown
• Consent banner detection — recognizes major CMPs including OneTrust, Cookiebot, and Cookie Notice
• Compliance grading — assigns Pass, Warning, or Fail based on GDPR best practices
• Third-party cookie analysis — flags cookies from external domains (Facebook, Google, HubSpot, Hotjar, etc.)
• Post-consent comparison — captures cookies before and after accepting consent to show what changes
• Bulk scanning — process hundreds of URLs in a single run for agency-scale audits

Input

Field	Type	Required	Default	Description
urls	array	Yes	—	Website URLs to scan for cookie compliance. Each URL is loaded in a real browser to capture all cookies, including those set by JavaScript.
waitForBanner	boolean	No	true	When enabled, the scanner waits for a cookie consent banner to appear and attempts to click "Accept" to compare pre- and post-consent cookies. Disable if you only want the pre-consent snapshot.
timeout	integer	No	30000	Maximum time in milliseconds to wait for page load and banner detection. Increase for slow-loading sites or complex single-page applications. Range: 5,000–120,000 ms.

Input Example

{
  "urls": [
    { "url": "https://crawlee.dev" },
    { "url": "https://example.com" }
  ],
  "waitForBanner": true,
  "timeout": 30000
}

Output

Each scanned URL produces a detailed compliance report with cookie inventories, categorization, consent banner status, and a compliance grade.

Key output fields:

• url — the scanned page URL
• complianceGrade — Pass, Warning, or Fail
• issues — list of specific compliance problems found
• preConsentCookies — cookies present before any user interaction
• postConsentCookies — cookies added after accepting the consent banner
• cookiesSetWithoutConsent — non-necessary cookies loaded before consent (the main GDPR risk)
• consentBannerDetected — whether a cookie consent banner was found
• consentManagementPlatform — detected CMP (OneTrust, Cookiebot, etc.)
• totalCookies — total cookie count across the session
• trackingCookies — number of identified tracking cookies
• thirdPartyCookies — cookies from external domains

Output Example

{
  "url": "https://example.com",
  "timestamp": "2025-01-15T10:30:00.000Z",
  "complianceGrade": "Fail",
  "issues": [
    "3 non-necessary cookies set before consent",
    "2 tracking cookies set before consent"
  ],
  "consentBannerDetected": true,
  "consentManagementPlatform": "OneTrust",
  "totalCookies": 12,
  "trackingCookies": 5,
  "preConsentCookies": [
    {
      "cookie": { "name": "_ga", "domain": ".example.com", "path": "/", "expires": 1737000000 },
      "category": "analytics",
      "isTracker": true,
      "trackerType": "Google Analytics"
    }
  ],
  "thirdPartyCookies": [
    {
      "cookie": { "name": "_fbp", "domain": ".facebook.com", "path": "/", "expires": 1737000000 },
      "category": "marketing",
      "isTracker": true,
      "trackerType": "Facebook Pixel"
    }
  ]
}

Pricing

Event	Cost
Site Scanned	$0.01 per URL

Free tier available — pay only for Apify platform usage beyond free limits.

Use Cases

• Privacy compliance audits — scan client websites before GDPR audits and generate evidence-ready reports showing cookie violations
• Agency client reporting — run bulk scans across all client domains on a schedule and flag new compliance issues automatically
• Vendor due diligence — verify that third-party SaaS tools and marketing platforms are not setting tracking cookies without consent
• Pre-launch QA — check new websites or redesigns for cookie compliance before going live
• Competitive benchmarking — compare cookie practices across competitors to identify industry-standard consent implementations

Related Actors

Actor	What it adds
Security Headers Analyzer	Audit HTTP security headers alongside cookie compliance for a full privacy and security review
Tech Stack Analyzer	Identify the CMS, frameworks, and third-party scripts that may be setting the cookies you found
Broken Links Checker	Combine cookie compliance with broken-link detection for a comprehensive site health audit

Notes

• The scanner uses a real Chromium browser via Playwright, so it captures JavaScript-set cookies that HTTP-only scanners miss.
• Consent banner detection relies on common CMP selectors (OneTrust, Cookiebot, generic patterns). Custom or uncommon banners may not be detected.
• Compliance grading is advisory — it highlights common GDPR issues but does not constitute legal advice.