SiteVerdict — Cookie & Privacy Policy Checker + Draft Generator

Does your cookie policy match what your website actually sets? Get the gaps, the evidence and a draft fix in about a minute per site.

The checker loads your site three times in real Chrome: no click, after Reject and after Accept. It builds the real cookie and tracker inventory, then reads your privacy and cookie policies and shows:

• which cookies and providers the policy is missing;
• which UK GDPR Art 13/14 elements the privacy notice lacks, with quotes as evidence;
• whether anything non-essential runs before consent or after Reject.

It then drafts the missing cookie table and policy wording for you to review.

Not legal advice. These are automated, heuristic risk indicators and DRAFT templates. We are not lawyers. Drafts must be reviewed by the site owner and a qualified adviser before use.

Why this one

	SiteVerdict	Typical cookie / privacy scanner
Inventory from 3 consent states (no click / Reject / Accept)	✅	❌ one load, or "accept" only
Reject confirmed by reading the consent tool's own record before reporting "after Reject" issues	✅ (confidence on every finding)	❌
Inventory vs policy text (cookie names, _ga_* patterns, providers)	✅ with quotes	❌ "policy link found: yes/no"
Art 13/14 checklist with evidence quote + section	✅ 15 elements	❌ or presence only
DRAFT cookie table + cookie policy from observed cookies	✅ Markdown / HTML / CSV	❌
Client report PDF (white-label)	✅	❌
Monitoring: policy text changed, new cookies not in the policy, new pre-consent cookies → Slack / webhook	✅	❌
AI-drafted wording for the gaps, with your own key	✅ optional	❌
Bot-protection pages	blocked, not charged	often reported as "no cookies"

Three ways customers use it

1. Web agencies: hand clients a branded PDF that says what the site sets, what the policy is missing, and includes a draft cookie table to paste in.
2. DPOs and privacy consultants: run a monthly monitor across clients. You get an alert when a new cookie or tracker appears that the policy does not mention, or when the policy text changes.
3. Small businesses: after adding GA4, Meta Pixel, Hotjar or a chat widget, run the check and get the exact rows to add to the cookie table.

Before / after

A typical scanner:

privacy policy: found   cookie policy: found   cookies: 31   banner: yes

SiteVerdict (shortened):

{
  "riskLevel": "high",
  "consentBehaviour": { "rejectVerification": "confirmed", "nonEssentialAfterReject": ["_fbp (.shop.example.co.uk, Meta (Facebook), marketing)"] },
  "mismatches": { "cookiesNotInPolicy": ["_clck (.shop.example.co.uk, Microsoft Clarity, analytics)"], "vendorsNotInPolicy": ["Microsoft Clarity"], "vendorsInPolicyNotObserved": ["Hotjar"] },
  "privacyNoticeCompleteness": 73,
  "privacyNoticeChecks": [{ "label": "Right to complain to the ICO", "status": "partial", "evidence": [{ "quote": "You can lodge a complaint with a supervisory authority.", "section": "Your rights" }] }],
  "drafts": { "generated": true, "cookieTableMarkdownUrl": "…/draft-cookie-table-shop-example-co-uk.md" },
  "clientReport": { "pdfUrl": "…/client-report-shop-example-co-uk.pdf" }
}

Benchmark

⟦PPC_BENCH⟧

The method, the site list and caveats are in BENCHMARK.md. Competitor Actors were compared on their documented outputs only; they were not run.

Pricing (pay per event)

Event	When	Price
site-checked	A site was checked: 3 consent states + policy pages	$0.15
draft-generated	DRAFT cookie policy + cookie table produced; only when at least one cookie or storage item was observed	$0.20
client-report	Client PDF + HTML produced (clientReport)	$0.05
ai-fix-generated	AI-drafted wording produced with your own key (off by default)	$0.04
alert-sent	Slack / webhook digest delivered	$0.01

Examples:

Job	Cost
1 site + draft + PDF	$0.40
50 client sites, check + PDF	$10
Monthly monitor of 30 sites with alerts	≈ $4.51/month

Blocked or failed sites are not charged. Set a maximum total charge per run and the Actor stops cleanly when it is reached.

Input

{
  "startUrls": [{ "url": "https://www.example.co.uk" }],
  "generateDrafts": true,
  "clientReport": true,
  "reportAgencyName": "Your Agency Ltd",
  "maxInternalPages": 1,
  "monitoringMode": false,
  "aiFix": false
}

If your policies are not found automatically, set privacyPolicyUrl / cookiePolicyUrl. These only apply when you check a single site.

Monitoring: set monitoringMode: true with a monitorName and schedule the Actor. Each item gets a change object, for example:

"change": { "changed": true, "policyTextChanged": false, "newCookiesNotInPolicy": ["_ttp"], "headline": "1 new cookie(s) not in the policy: _ttp · new trackers: TikTok Pixel" }

Only a hash of the policy text is stored, never the text itself. Add slackWebhookUrl / webhookUrl (secret) for alerts.

AI drafting (optional): set aiFix: true, aiProvider and aiApiKey (your key, secret). It drafts the cookie-table rows, the privacy-notice wording for missing elements and the consent-tool changes. Anything not observed is left as a [PLACEHOLDER].

Output

• Dataset views:
  • Overview
  • Cookie inventory (CSV export)
  • Risk indicators
  • Privacy notice checks (Art 13/14)
  • Mismatches
  • Changes (monitoring)
• Key-value store, per site:
  • draft-cookie-policy-<site>.md / .html
  • draft-cookie-table-<site>.md
  • cookie-inventory-<site>.csv
  • client-report-<site>.pdf / .html
  • ai-fix-<site>.md
• Key-value store, run level: REPORT (HTML) and SUMMARY (JSON).

How accuracy is protected

• "After Reject" counts only cookies and storage that are new after the click. Items already set before consent are reported once, as "before consent".
• The Reject click is read back from the consent tool: OneTrust, Cookiebot, CookieYes, Didomi, Usercentrics, Osano, TrustArc, iubenda, Complianz, Transcend, IAB TCF, the Google CMP, GOV.UK/NHS-style JSON cookies, and Google Consent Mode. If the tool recorded the opposite of the click, it is a "check manually" item and is not scored.
• These do not count as trackers firing:
  • script downloads;
  • cookieless Consent Mode / UET pings;
  • Google limited-ads requests;
  • embedded video players. Their cookies are still classified individually.
• Generic cookie names (sb, SM, UID, MUID…) are matched only on the vendor's domain. Google AEC/SOCS are strictly necessary, and YouTube YSC is functional.
• Unknown cookies are left unclassified for you to confirm. They are never guessed.

FAQ

Is this a compliance certificate? No. It is an indicator tool, not legal advice. Keyword checks can miss wording that is present, or accept wording that is weak. A person must review the results.

Why might the inventory miss cookies? Only the pages visited are scanned. Logged-in areas, checkouts, geo-targeted tags and A/B tests can be missed. If Accept cannot be clicked, cookies that load after consent are missing, and this is flagged.

Does it work for non-English policies? The policy-text checks are English heuristics. The inventory and consent tests work in any language. Button detection covers EN/FR/DE/ES/IT/PT/NL.

Does it bypass bot protection? No. It never solves CAPTCHAs or bypasses protection. Blocked sites are reported as blocked and not charged. Policy pages respect robots.txt for the token SiteVerdict.

Limits

• One location per run (an Apify Proxy country is optional), and one snapshot in time.
• Policies that are PDFs, sit inside iframes, or use JavaScript-only accordions that do not render text may not be extracted.
• About 1–2 minutes per site. The default is 2 sites in parallel at 2 GB.

Compliance & sources

• UK GDPR Art 13/14. ICO, Right to be informed.
• PECR reg 6. ICO, storage and access technologies guidance.
• ICO consent-or-pay guidance (2025) and the ICO's work on making "Reject all" as easy as "Accept all".
• EU ePrivacy Directive Art 5(3). EDPB Cookie Banner Taskforce report (Jan 2023); EDPB Guidelines 2/2023.
• CNIL cookie guidelines (2020).
• Data (Use and Access) Act 2025 (UK).

References were checked against the public sources as of October 2026.

Personal data:

• No personal data about individuals is collected.
• Only cookie names, domains and expiry are recorded; values are never recorded.
• Consent-cookie values are parsed in memory and only the yes/no result is kept.
• Identifiers are redacted from evidence URLs.

Built by SiteVerdict (BharatFare Travel and Technologies Ltd, UK). Pairs with the SiteVerdict Cookie Consent & Consent Mode v2 Auditor, which adds the PDF evidence pack, the request timeline and the Consent Mode v2 checklist. Contact: aman.thakran@bharatfare.com.