# Cookie & GDPR Compliance Checker (`arched_friend/cookie-compliance-checker`) Actor

Load any site the way a first-time visitor does, touch nothing, and report every cookie set and every tracker called before consent was given. Detects the consent banner, finds the privacy and cookie policy links, and flags the trackers that fired anyway.

- **URL**: https://apify.com/arched\_friend/cookie-compliance-checker.md
- **Developed by:** [Peach O](https://apify.com/arched_friend) (community)
- **Categories:** Developer tools, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$10.00 / 1,000 page checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Cookie & GDPR Compliance Checker: What Fires Before Anyone Consents

Loads your site the way a first-time visitor does, touches nothing, and reports every cookie set and every tracker contacted **before consent was given**. That narrow question is what enforcement actions are actually about.

Built for privacy and marketing teams who have a consent banner installed and no idea whether it works.

### How it works

```mermaid
flowchart LR
    A["Your pages"] --> B["Open in a real browser<br/>(fresh profile)"]
    B --> C["Wait. Click nothing."]
    C --> D["Read cookies + every<br/>request the page made"]
    D --> E["Classify by purpose<br/>and vendor"]
    E --> F{"Anything needing<br/>consent?"}
    F -->|yes| G["at-risk"]
    F -->|analytics only| H["review"]
    F -->|no| I["clean"]
```

Having a banner is not the same as the banner working. On a real run, a site with **OneTrust installed and its banner visible** still set 10 consent-requiring cookies from HubSpot, Google Analytics, Google Ads, TikTok and Clarity before anything was clicked.

### Why it uses a real browser

A tag manager injects most of the tracking stack at runtime, so reading the HTML source finds almost nothing. This loads the page properly and records **both** signals:

- **Cookies actually written**, read scoped to the page so one site's jar can never be reported against another
- **Every request the page made**, because a call to `connect.facebook.net` counts as tracking even when no cookie is written yet

Each page gets a fresh browser profile. Without that, cookies from the previous page stay in the jar and the second site inherits the first site's findings.

### A session cookie is not a violation

Only analytics and marketing cookies need prior consent. Session, CSRF, load-balancer and Cloudflare cookies are strictly necessary and are **not** counted as findings — lumping them in is what makes most compliance reports impossible to act on.

| Category | Needs consent | Examples |
| --- | --- | --- |
| Necessary | No | `PHPSESSID`, `csrf_token`, `__cf_bm`, `__Host-*` |
| Functional | No | `lang`, `currency`, `theme` |
| **Analytics** | **Yes** | `_ga`, `_hj*`, `_clck`, `_pk_*` |
| **Marketing** | **Yes** | `_fbp`, `_gcl_au`, `_ttp`, `bcookie`, `hubspotutk` |

### Built for

- **Privacy and legal teams** who need evidence, not a vendor's assurance
- **Marketing teams** who added a pixel and want to know if it broke consent
- **Agencies** auditing a client site before a launch
- **Anyone trading in the EU or UK**, where this is the enforced part of the rules

### Input

```json
{
  "startUrls": [
    "https://yoursite.com",
    "https://yoursite.com/pricing",
    "https://yoursite.com/checkout"
  ],
  "waitSecs": 7
}
```

Check more than the home page. Landing and checkout pages routinely load trackers the home page does not.

| Setting | What it does |
| --- | --- |
| `startUrls` | The pages to load as a first-time visitor |
| `waitSecs` | How long to sit doing nothing before reading cookies |
| `onlyPagesAtRisk` | Return only the pages with a real finding |
| `proxyConfiguration` | Use an EU exit to see the banner a European visitor gets |

### Output

```json
{
  "url": "https://yoursite.com/",
  "verdict": "at-risk",
  "cookiesBeforeConsent": 10,
  "trackersBeforeConsent": 8,
  "totalCookies": 26,
  "consentPlatforms": ["OneTrust"],
  "bannerDetected": true,
  "hasPrivacyPolicyLink": true,
  "trackers": [{ "vendor": "TikTok", "category": "marketing", "host": "analytics.tiktok.com" }],
  "cookies": [
    { "name": "hubspotutk", "category": "marketing", "vendor": "HubSpot", "firstParty": true, "requiresConsent": true }
  ],
  "issues": [
    {
      "code": "cookies-before-consent",
      "severity": "critical",
      "message": "10 cookies requiring consent (HubSpot, Google Analytics, Google Ads, TikTok, Clarity) were set before any consent was given."
    }
  ]
}
```

`verdict` is the field to scan: **at-risk** means consent-requiring cookies or marketing trackers fired unprompted, **review** means analytics were contacted without a cookie being written, **clean** means neither.

### What it does not do

- It does not click "accept" — the whole point is the state before anyone does
- It does not give legal advice; it gives evidence for whoever does
- It cannot tell a legitimate interest argument from a violation — that is a lawyer's call on your facts
- `waitSecs` matters: a tag manager that fires after 8 seconds is missed by a 5-second wait

### Run it as an API

```bash
curl -X POST "https://api.apify.com/v2/acts/arched_friend~cookie-compliance-checker/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "startUrls": ["https://yoursite.com"],
    "waitSecs": 7
  }'
```

### Pricing

You pay $0.01 for each page checked, browser and all.

| Checking 20 pages weekly | Monthly cost |
| --- | --- |
| A consultant's cookie audit | £1,000 to £5,000 one-off |
| Consent management suites | €30 to €400 per month |
| This Actor | $0.80 per month |

### Common questions

**My banner is installed, so why am I "at-risk"?** Because the banner being present and the trackers being blocked are two different things. The commonest cause is a tag firing outside the consent platform's control, often one added directly to the template rather than through the tag manager.

**Why is a first-party cookie flagged?** Modern pixels write first-party cookies deliberately, to survive browser restrictions. `hubspotutk` and `_fbp` sit on your own domain and are still marketing cookies.

**Does a "clean" verdict mean I am compliant?** No. It means nothing needing consent fired on the pages checked. Compliance also covers your policies, your legal basis, your retention and your processors.

**Why did the BBC come back at-risk with zero cookies?** Because it contacted an ad host before consent even though it set no cookie. Both signals are reported, and the request is the one a cookie-only checker misses.

### Related products

- **Website Accessibility Checker** for the other regulatory sweep of the same site
- **Tech Stack Checker** to inventory every third-party tool you are running
- **Website Change Monitor** to catch it when someone adds a tag back
- **Email Deliverability Checker** for the SPF, DKIM and DMARC side of trust

# Actor input Schema

## `startUrls` (type: `array`):

The pages to load as a first-time visitor, one per line. Check your home page, a landing page and a checkout page: they often load different trackers.

## `maxPages` (type: `integer`):

Upper limit on how many of the listed pages to check. This is what the run is charged on.

## `waitSecs` (type: `integer`):

How long to sit on the page doing nothing before reading the cookies. Tag managers often fire a second or two after load, so too short a wait under-reports.

## `onlyPagesAtRisk` (type: `boolean`):

Return only pages that set consent-requiring cookies or load marketing trackers before consent.

## `maxConcurrency` (type: `integer`):

How many pages to load at once. Each uses its own browser context, so this costs memory.

## `proxyConfiguration` (type: `object`):

Optional. Use a proxy in an EU country to see the consent banner a European visitor is served, which is often different.

## Actor input object example

```json
{
  "startUrls": [
    "https://apify.com"
  ],
  "maxPages": 10,
  "waitSecs": 6,
  "onlyPagesAtRisk": false,
  "maxConcurrency": 3
}
```

# Actor output Schema

## `pages` (type: `string`):

One row per page with every cookie set and tracker contacted before consent, each classified by purpose and vendor.

## `runSummary` (type: `string`):

How many pages are at risk, which consent platform was found, and which tracking vendors appear across the site.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "startUrls": [
        "https://apify.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("arched_friend/cookie-compliance-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "startUrls": ["https://apify.com"] }

# Run the Actor and wait for it to finish
run = client.actor("arched_friend/cookie-compliance-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "startUrls": [
    "https://apify.com"
  ]
}' |
apify call arched_friend/cookie-compliance-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,arched_friend/cookie-compliance-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/QPIFG2VcTMZqcR1Ai/builds/2dSGkGbHgOwviQvdp/openapi.json