Cookie Scanner — GDPR & security audit for any URL

Scan a page's cookies for privacy and security review. Parses every Set-Cookie into structured attributes (Secure, HttpOnly, SameSite, expiry), flags third-party and tracker cookies, guesses a GDPR category (analytics/ads/functional), and lists security issues. Single URL or bulk. $0.0008 per page. Failed fetches are recorded free.

What you get

• Per cookie: name, domain, path, secure, httpOnly, sameSite, expiresDays, session, thirdParty, category.
• Counts: cookieCount, sessionCount, persistentCount, thirdPartyCount, trackerCount.
• issues — security flags (missing Secure/HttpOnly, weak SameSite, long-lived trackers).
• Fail-soft: an unreachable URL returns {ok:false, error} and is never charged.

Input

{ "urls": ["https://github.com", "https://example.com"], "maxUrls": 25 }

Output (real run, 2026-08-07)

{
  "ok": true, "url": "https://github.com", "statusCode": 200,
  "cookieCount": 3, "sessionCount": 1, "persistentCount": 2, "thirdPartyCount": 0, "trackerCount": 0,
  "cookies": [
    { "name": "_gh_sess", "domain": "github.com", "secure": true, "httpOnly": true, "sameSite": "Lax", "session": true, "category": "unknown" }
  ]
}

Pricing — $0.0008 per page

Prices below checked via the Apify Store API on 2026-08-07:

Actor	Pricing	One page
This actor	$0.0008 per page	$0.0008
andok/gdpr-cookie-scanner	$0.001 per item	$0.001
delightful_unicorn/cookie-gdpr-checker	$0.00035 start + $0.0035 per item	$0.0039
glowing_glove/privacy-cookie-compliance-scanner	$0.006 per site	$0.006

Limits (honest ones)

• Reads cookies set in the HTTP response headers (Set-Cookie) on a single page load — it does not run JavaScript, so cookies set later by client-side scripts are not captured.
• GDPR category is a heuristic from the cookie name, meant to triage, not to certify compliance.
• maxUrls capped per run.

FAQ

• Does it capture JS-set cookies? No — it reads Set-Cookie response headers; client-side document.cookie writes are out of scope.
• What are the security flags? Missing Secure/HttpOnly, weak/absent SameSite, and long-lived third-party trackers.
• Is the GDPR category authoritative? It is a name-based heuristic for triage, not legal compliance certification.
• What about a dead URL? You get an {ok:false, error} record, uncharged.

Related actors

• HTTP Headers Inspector (EliAI/http-headers-inspector) — returns every raw response header (including Set-Cookie) with a security-header grade. This actor goes deeper on cookies specifically: it parses each one into attributes + GDPR/tracker flags.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~webpage-cookie-scanner/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' -d '{"urls":["https://github.com"]}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com).

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/webpage-cookie-scanner
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~webpage-cookie-scanner/run-sync-get-dataset-items
• Pay with x402, without an Apify account. This Actor is whitelisted for agentic payments, so an agent holding USDC on Base can buy a prepaid token and spend it here. The minimum purchase is $1, the token balance is an absolute spending cap, and it expires 14 days after purchase.
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.