Cookie and Tracker Scanner: cookies and tags before consent

Give it a list of web pages. It opens each one in a fresh headless Chrome, with no stored cookies, and does not touch the cookie banner. Then it tells you what the page did before the visitor said yes: every cookie set, every third party domain the page called, and the analytics, advertising, session replay, marketing and consent vendors behind them.

Turn on the accept comparison and it then clicks the banner's accept button and lists what was added after consent: new cookies, new third party domains and new vendors.

What it detects

• Cookies: name, domain, path, expiry (or session), HttpOnly, Secure, SameSite, whether it is first or third party, and the vendor its name belongs to. Cookie values are never read into the output.
• Requests: the total number, the third party requests, and each third party domain with its request count. First and third party are decided by the registrable domain, using the public suffix list, so static.example.co.uk counts as the same site as www.example.co.uk.
• Vendors: a built in list of 80 vendors matched by the hosts their scripts and beacons load from and the cookie names they set. It covers analytics (such as Google Analytics, Adobe Analytics, Segment, Amplitude), advertising pixels (such as Meta Pixel, Google Ads, LinkedIn Insight Tag, TikTok Pixel, Microsoft Advertising, The Trade Desk), session replay (Hotjar, Microsoft Clarity, FullStory), marketing automation (HubSpot, Marketo, Pardot, Klaviyo), tag managers, chat widgets, and 13 consent managers (OneTrust, Cookiebot, Usercentrics, TrustArc, Didomi, Sourcepoint and others). Each vendor comes with the evidence: the requests and cookie names that matched.

The accept click

The actor first looks for the accept buttons of known consent managers, such as OneTrust and Cookiebot, then for any visible button or link labeled Accept, Accept all, Accept additional cookies, Allow all, I agree, Got it and similar wording. It records which button it clicked. When it finds none, afterAccept.clicked is false with a note, and the rest of the result still stands.

Input

• Pages to scan (required)
• Compare after clicking accept (default off)
• Wait after load (default 5 seconds), applied again after clicking accept
• Page load timeout (default 45 seconds)

Output

Dataset: one item per page with url, ok, finalUrl, httpStatus, title, firstPartySite, cookieCount, thirdPartyCookieCount, requestCount, thirdPartyRequestCount, thirdPartyDomainCount, thirdPartyDomains, cookies, vendors (each with name, category and evidence), trackingVendors (vendors in the analytics, advertising, session replay, marketing and testing categories), consentManagers and scannedAt.

With the accept comparison: afterAccept with clicked, method, the selector or buttonText used, cookieCount and requestCount after consent, newCookies, newThirdPartyDomains and newVendors.

A page that cannot be loaded gets ok: false and an error, and the rest of the run carries on. Export as JSON, CSV or Excel, or read it over the API.

Pricing

Pay per event: one event per page scanned, with or without the accept comparison. A page that fails is not charged. The run stops when it reaches the maximum charge you set.

Scope and conduct

Only the pages you list are opened, one at a time, each in a fresh browser. The actor clicks nothing except the accept button, and only when you turn the comparison on. It does not log in anywhere, fill in forms, or collect personal data, and cookie values stay out of the results. The result describes what the browser saw on one visit from the actor's location. It is a technical scan, not legal advice.

Support

Questions and problems: the Issues tab on this page. Replies are written by an AI assistant on behalf of the developer and reviewed by the developer.