Cookie & Tracker Scanner 🍪🔎

Scan any URL for the cookies it sets and the third-party analytics & advertising trackers it loads — in seconds, with no API key. Built for privacy engineers, GDPR/ePrivacy auditors, adtech researchers and compliance teams who need fast, structured evidence of what a web page is actually doing.

Point it at a list of URLs and get back, per page: every cookie parsed from the Set-Cookie response headers (name, domain, Secure, HttpOnly, SameSite) plus a list of detected trackers (Google Analytics, Meta Pixel, Hotjar, TikTok Pixel, and 11 more) with the evidence URL that triggered each match.

---

Why use it

• GDPR / ePrivacy audits — document cookies and trackers set before consent, check Secure/HttpOnly/SameSite hygiene, and build an evidence trail for your cookie policy or DPA.
• Adtech & martech research — see which analytics and ad platforms a site (or a whole list of competitors) runs.
• Compliance monitoring — re-run against your own domains on a schedule to catch a rogue pixel someone dropped into a tag manager.
• Competitive intelligence — map the measurement and advertising stack of any site.

What it detects

Cookies: every Set-Cookie header, parsed into {name, domain, secure, httponly, samesite}.

Trackers (15 signatures): Google Analytics / gtag, Google Ads, Meta Pixel, Hotjar, Mixpanel, Segment, Amplitude, HubSpot, Intercom, TikTok Pixel, LinkedIn Insight, Cloudflare Insights, Plausible, Matomo, Yandex Metrica. Each detection includes the evidence (the script/resource URL or snippet that matched) and is flagged as analytics or advertising, rolled up into has_analytics / has_ads booleans.

Input

Field	Type	Description
mode	select	Operation mode. Currently scan (cookies + trackers).
urls	array	Page URLs to scan. Bare domains are auto-prefixed with https://.
maxItems	integer	Max URLs to scan per run (1–1000, default 100).

{
  "mode": "scan",
  "urls": ["https://www.cnn.com", "https://techcrunch.com"],
  "maxItems": 100
}

Output

One dataset item per URL:

{
  "url": "https://www.theverge.com",
  "final_url": "https://www.theverge.com/",
  "cookie_count": 2,
  "cookies": [
    {"name": "vmidv1", "domain": "www.theverge.com", "secure": true, "httponly": false, "samesite": "Lax"}
  ],
  "tracker_count": 2,
  "trackers": [
    {"name": "Google Analytics / gtag", "category": "analytics", "evidence": "https://www.googletagmanager.com/gtag/js?id=G-..."},
    {"name": "Google Ads", "category": "ads", "evidence": "https://googleads.g.doubleclick.net/..."}
  ],
  "has_analytics": true,
  "has_ads": true,
  "source": "cookie-scanner",
  "scraped_at": "2026-07-24T18:20:00+00:00"
}

Pricing

Runs on tiny compute (512 MB) — roughly $0.5 per 1,000 URLs scanned, plus Apify platform usage. Pay only for what you scan.

Notes & limits

• Analyzes the initial server response (HTML + headers). Trackers injected purely client-side after heavy JS execution may not appear; most tags are present in the initial document or its tag-manager snippet.
• This is a passive, read-only auditing tool. It does not accept or reject consent banners on your behalf.

Related actors

• HTTP Headers Inspector
• Website Tech Stack Detector
• Security Headers Checker
• SSL Certificate Checker