# Cookie Consent Violation Checker (`proficientstack/cookie-consent-violation-checker`) Actor

Opens a site in a real browser, touches nothing, and records which third-party trackers fire before any consent is given. Returns the actual network requests as evidence, not a guess read from the HTML.

- **URL**: https://apify.com/proficientstack/cookie-consent-violation-checker.md
- **Developed by:** [Gabriel Barreto](https://apify.com/proficientstack) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-usage

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Cookie Consent Violation Checker

Opens a site in a real browser, **touches nothing**, and records which third-party trackers fire anyway.

No clicks. No "Accept". No scrolling. No cookies carried over from a previous site. If a request to `facebook.com/tr` left the browser, it left without consent — and you get the request URL as evidence, not an inference read from the HTML.

### Why this is evidence and not an opinion

Most "cookie scanners" grep the page source for a pixel snippet. That proves nothing: a tag manager may hold the tag until consent, or fire it server-side. This Actor watches the network layer of an actual Chromium instance. What it reports is the request that happened.

**Legal context (not legal advice):** Article 5(3) of the ePrivacy Directive (2002/58/EC) requires *prior* consent before storing or accessing information on a user's device, unless strictly necessary for the service requested. In *Planet49* (C-673/17) the CJEU held that consent must be an active choice. Analytics and advertising are not strictly necessary. This Actor reports the technical fact; what to do about it is for you and your counsel.

### Who this is for

- **Agencies and consultants** doing a privacy or compliance audit before a pitch, with a finding the prospect can reproduce in ten seconds.
- **Anyone who installed a consent banner** and wants to know whether it actually holds the tags back — a very common misconfiguration is a banner that displays while the tags load behind it.
- **Privacy and legal teams** building a defensible record of what a site did, with timestamps and URLs.

### What it refuses to report

- **First-party requests.** A request to the site's own domain proves nothing — it may be the page itself, a font, or the consent platform loading.
- **The consent platform itself.** OneTrust, Cookiebot, Usercentrics, Didomi, Iubenda and the rest *must* load before the choice is made; that is their job. Counting them would accuse a site of doing exactly what it is supposed to do. They are reported separately in `consent_platform`.
- **Universal illegality.** Prior-consent rules are EU/EEA and UK rules. The `jurisdiction_note` field says so in plain words instead of letting a list imply a violation everywhere.

### Input

| Field | Type | Description |
|---|---|---|
| `urls` | string list | Sites to check, one per line. |
| `onlyTargets` | boolean | Return only sites where a tracker fired before consent. |

```json
{
    "urls": ["bbc.co.uk", "example.com"],
    "onlyTargets": false
}
```

### Output

| Field | Meaning |
|---|---|
| `finding` | e.g. "3 third-party tracker(s) loaded before any consent was given: Google Analytics, Meta (Facebook) Pixel, TikTok Pixel". |
| `trackers_before_consent` | How many distinct trackers fired. |
| `evidence` | The actual request URL observed for each tracker. |
| `consent_platform` | Which consent platform was detected, or `none detected`. |
| `jurisdiction_note` | Whether the domain suggests a jurisdiction where prior consent is required. |
| `how_to_verify` | How to reproduce the finding yourself, in a private window. |
| `legal_basis` | The directive and case law the context rests on. |

### Pricing

Pay per site with findings. Clean sites, sites that fail to load, and sites outside the relevant jurisdiction are all returned in the dataset **free of charge**.

### Notes

Each site gets a **fresh browser context** with no stored cookies. Without that, a consent cookie set on site A can suppress the banner on site B and quietly corrupt every result after the first.

# Actor input Schema

## `urls` (type: `array`):

One site per line. Paste domains (example.com) or full URLs. Each site is loaded in a fresh browser context, with no clicks and no cookies carried over.

## `onlyTargets` (type: `boolean`):

Skip sites where no third-party tracker fired before consent.

## Actor input object example

```json
{
  "urls": [
    "bbc.co.uk",
    "example.com"
  ],
  "onlyTargets": false
}
```

# Actor output Schema

## `findings` (type: `string`):

One row per site: which trackers fired before consent, the request URLs as evidence, the consent platform detected, and a jurisdiction note.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "bbc.co.uk",
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("proficientstack/cookie-consent-violation-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "bbc.co.uk",
        "example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("proficientstack/cookie-consent-violation-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "bbc.co.uk",
    "example.com"
  ]
}' |
apify call proficientstack/cookie-consent-violation-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,proficientstack/cookie-consent-violation-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/6qiquxarj1M8Gr67T/builds/RZjnWHdRLfKqeYfUu/openapi.json