Cookie & GDPR Compliance Checker: What Fires Before Anyone Consents

Loads your site the way a first-time visitor does, touches nothing, and reports every cookie set and every tracker contacted before consent was given. That narrow question is what enforcement actions are actually about.

Built for privacy and marketing teams who have a consent banner installed and no idea whether it works.

How it works

flowchart LR
    A["Your pages"] --> B["Open in a real browser<br/>(fresh profile)"]
    B --> C["Wait. Click nothing."]
    C --> D["Read cookies + every<br/>request the page made"]
    D --> E["Classify by purpose<br/>and vendor"]
    E --> F{"Anything needing<br/>consent?"}
    F -->|yes| G["at-risk"]
    F -->|analytics only| H["review"]
    F -->|no| I["clean"]

Having a banner is not the same as the banner working. On a real run, a site with OneTrust installed and its banner visible still set 10 consent-requiring cookies from HubSpot, Google Analytics, Google Ads, TikTok and Clarity before anything was clicked.

Why it uses a real browser

A tag manager injects most of the tracking stack at runtime, so reading the HTML source finds almost nothing. This loads the page properly and records both signals:

• Cookies actually written, read scoped to the page so one site's jar can never be reported against another
• Every request the page made, because a call to connect.facebook.net counts as tracking even when no cookie is written yet

Each page gets a fresh browser profile. Without that, cookies from the previous page stay in the jar and the second site inherits the first site's findings.

A session cookie is not a violation

Only analytics and marketing cookies need prior consent. Session, CSRF, load-balancer and Cloudflare cookies are strictly necessary and are not counted as findings — lumping them in is what makes most compliance reports impossible to act on.

Category	Needs consent	Examples
Necessary	No	PHPSESSID, csrf_token, __cf_bm, __Host-*
Functional	No	lang, currency, theme
Analytics	Yes	_ga, _hj*, _clck, _pk_*
Marketing	Yes	_fbp, _gcl_au, _ttp, bcookie, hubspotutk

Built for

• Privacy and legal teams who need evidence, not a vendor's assurance
• Marketing teams who added a pixel and want to know if it broke consent
• Agencies auditing a client site before a launch
• Anyone trading in the EU or UK, where this is the enforced part of the rules

Input

{
  "startUrls": [
    "https://yoursite.com",
    "https://yoursite.com/pricing",
    "https://yoursite.com/checkout"
  ],
  "waitSecs": 7
}

Check more than the home page. Landing and checkout pages routinely load trackers the home page does not.

Setting	What it does
startUrls	The pages to load as a first-time visitor
waitSecs	How long to sit doing nothing before reading cookies
onlyPagesAtRisk	Return only the pages with a real finding
proxyConfiguration	Use an EU exit to see the banner a European visitor gets

Output

{
  "url": "https://yoursite.com/",
  "verdict": "at-risk",
  "cookiesBeforeConsent": 10,
  "trackersBeforeConsent": 8,
  "totalCookies": 26,
  "consentPlatforms": ["OneTrust"],
  "bannerDetected": true,
  "hasPrivacyPolicyLink": true,
  "trackers": [{ "vendor": "TikTok", "category": "marketing", "host": "analytics.tiktok.com" }],
  "cookies": [
    { "name": "hubspotutk", "category": "marketing", "vendor": "HubSpot", "firstParty": true, "requiresConsent": true }
  ],
  "issues": [
    {
      "code": "cookies-before-consent",
      "severity": "critical",
      "message": "10 cookies requiring consent (HubSpot, Google Analytics, Google Ads, TikTok, Clarity) were set before any consent was given."
    }
  ]
}

verdict is the field to scan: at-risk means consent-requiring cookies or marketing trackers fired unprompted, review means analytics were contacted without a cookie being written, clean means neither.

What it does not do

• It does not click "accept" — the whole point is the state before anyone does
• It does not give legal advice; it gives evidence for whoever does
• It cannot tell a legitimate interest argument from a violation — that is a lawyer's call on your facts
• waitSecs matters: a tag manager that fires after 8 seconds is missed by a 5-second wait

Run it as an API

curl -X POST "https://api.apify.com/v2/acts/arched_friend~cookie-compliance-checker/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "startUrls": ["https://yoursite.com"],
    "waitSecs": 7
  }'

Pricing

You pay $0.01 for each page checked, browser and all.

Checking 20 pages weekly	Monthly cost
A consultant's cookie audit	£1,000 to £5,000 one-off
Consent management suites	€30 to €400 per month
This Actor	$0.80 per month

Common questions

My banner is installed, so why am I "at-risk"? Because the banner being present and the trackers being blocked are two different things. The commonest cause is a tag firing outside the consent platform's control, often one added directly to the template rather than through the tag manager.

Why is a first-party cookie flagged? Modern pixels write first-party cookies deliberately, to survive browser restrictions. hubspotutk and _fbp sit on your own domain and are still marketing cookies.

Does a "clean" verdict mean I am compliant? No. It means nothing needing consent fired on the pages checked. Compliance also covers your policies, your legal basis, your retention and your processors.

Why did the BBC come back at-risk with zero cookies? Because it contacted an ad host before consent even though it set no cookie. Both signals are reported, and the request is the one a cookie-only checker misses.

Related products

• Website Accessibility Checker for the other regulatory sweep of the same site
• Tech Stack Checker to inventory every third-party tool you are running
• Website Change Monitor to catch it when someone adds a tag back
• Email Deliverability Checker for the SPF, DKIM and DMARC side of trust