SiteVerdict — Cookie & Privacy Policy Checker + Draft Generator

Does your cookie policy match what your website actually sets? Get the gaps, the evidence and a draft fix in about a minute per site.

The checker loads your site three times in real Chrome: no click, after Reject and after Accept. It builds the real cookie and tracker inventory, then reads your privacy and cookie policies and shows:

• which cookies and providers the policy is missing;
• which UK GDPR Art 13/14 elements the privacy notice lacks, with quotes as evidence;
• whether anything non-essential runs before consent or after Reject.

It then drafts the missing cookie table and policy wording for you to review.

Not legal advice. These are automated, heuristic risk indicators and DRAFT templates. We are not lawyers. Drafts must be reviewed by the site owner and a qualified adviser before use.

Why this one

	SiteVerdict	Typical cookie / privacy scanner
Inventory from 3 consent states (no click / Reject / Accept)	✅	❌ one load, or "accept" only
Reject confirmed by reading the consent tool's own record before reporting "after Reject" issues	✅ (confidence on every finding)	❌
Inventory vs policy text (cookie names, _ga_* patterns, providers)	✅ with quotes	❌ "policy link found: yes/no"
Art 13/14 checklist with evidence quote + section	✅ 15 elements	❌ or presence only
DRAFT cookie table + cookie policy from observed cookies	✅ Markdown / HTML / CSV	❌
Client report PDF (white-label)	✅	❌
Monitoring: policy text changed, new cookies not in the policy, new pre-consent cookies → Slack / webhook	✅	❌
AI-drafted wording for the gaps, with your own key	✅ optional	❌
Bot-protection pages	blocked, not charged	often reported as "no cookies"

Three ways customers use it

1. Web agencies: hand clients a branded PDF that says what the site sets, what the policy is missing, and includes a draft cookie table to paste in.
2. DPOs and privacy consultants: run a monthly monitor across clients. You get an alert when a new cookie or tracker appears that the policy does not mention, or when the policy text changes.
3. Small businesses: after adding GA4, Meta Pixel, Hotjar or a chat widget, run the check and get the exact rows to add to the cookie table.

Before / after

A typical scanner:

privacy policy: found   cookie policy: found   cookies: 31   banner: yes

SiteVerdict (shortened):

{
  "riskLevel": "high",
  "consentBehaviour": { "rejectVerification": "confirmed", "nonEssentialAfterReject": ["_fbp (.shop.example.co.uk, Meta (Facebook), marketing)"] },
  "mismatches": { "cookiesNotInPolicy": ["_clck (.shop.example.co.uk, Microsoft Clarity, analytics)"], "vendorsNotInPolicy": ["Microsoft Clarity"], "vendorsInPolicyNotObserved": ["Hotjar"] },
  "privacyNoticeCompleteness": 73,
  "privacyNoticeChecks": [{ "label": "Right to complain to the ICO", "status": "partial", "evidence": [{ "quote": "You can lodge a complaint with a supervisory authority.", "section": "Your rights" }] }],
  "drafts": { "generated": true, "cookieTableMarkdownUrl": "…/draft-cookie-table-shop-example-co-uk.md" },
  "clientReport": { "pdfUrl": "…/client-report-shop-example-co-uk.pdf" }
}

Benchmark

⟦PPC_BENCH⟧

The method, the site list and caveats are in BENCHMARK.md. Competitor Actors were compared on their documented outputs only; they were not run.

Pricing (pay per event)

Event	When	Price
site-checked	A site was checked: 3 consent states + policy pages	$0.15
draft-generated	DRAFT cookie policy + cookie table produced; only when at least one cookie or storage item was observed	$0.20
client-report	Client PDF + HTML produced (clientReport)	$0.05
ai-fix-generated	AI-drafted wording produced with your own key (off by default)	$0.04
alert-sent	Slack / webhook digest delivered	$0.01

Examples:

Job	Cost
1 site + draft + PDF	$0.40
50 client sites, check + PDF	$10
Monthly monitor of 30 sites with alerts	≈ $4.51/month

Blocked or failed sites are not charged. Each site is charged at most once per run: charges are made only after the site's result row is saved, and a retry or a restart of the run never charges the same site or add-on twice. Each row lists the events it is billed for in billedEvents. Set a maximum total charge per run: sites and add-ons that do not fit in what is left are skipped and not charged, and the run summary says so (chargeLimitReached, sitesSkippedForBudget). A budget that is used up exactly is not reported as a limit.

Input

{
  "startUrls": [{ "url": "https://www.example.co.uk" }],
  "generateDrafts": true,
  "clientReport": true,
  "reportAgencyName": "Your Agency Ltd",
  "maxInternalPages": 1,
  "monitoringMode": false,
  "aiFix": false
}

If your policies are not found automatically, set privacyPolicyUrl / cookiePolicyUrl. These only apply when you check a single site.

Monitoring: set monitoringMode: true with a monitorName and schedule the Actor. Each item gets a change object, for example:

"change": { "changed": true, "policyTextChanged": false, "newCookiesNotInPolicy": ["_ttp"], "headline": "1 new cookie(s) not in the policy: _ttp · new trackers: TikTok Pixel" }

Only a hash of the policy text is stored, never the text itself. Add slackWebhookUrl / webhookUrl (secret) for alerts.

AI drafting (optional): set aiFix: true, aiProvider and aiApiKey (your key, secret). It drafts the cookie-table rows, the privacy-notice wording for missing elements and the consent-tool changes. Anything not observed is left as a [PLACEHOLDER].

Output

• Dataset views:
  • Overview
  • Cookie inventory (CSV export)
  • Risk indicators
  • Privacy notice checks (Art 13/14)
  • Mismatches
  • Changes (monitoring)
• Key-value store, per site:
  • draft-cookie-policy-<site>.md / .html
  • draft-cookie-table-<site>.md
  • cookie-inventory-<site>.csv
  • client-report-<site>.pdf / .html
  • ai-fix-<site>.md
• Key-value store, run level: REPORT (HTML) and SUMMARY (JSON).

How accuracy is protected

• "After Reject" counts only cookies and storage that are new after the click. Items already set before consent are reported once, as "before consent".
• The Reject click is read back from the consent tool: OneTrust, Cookiebot, CookieYes, Didomi, Usercentrics, Osano, TrustArc, iubenda, Complianz, Transcend, IAB TCF, the Google CMP, GOV.UK/NHS-style JSON cookies, and Google Consent Mode. If the tool recorded the opposite of the click, it is a "check manually" item and is not scored.
• These do not count as trackers firing:
  • script downloads;
  • cookieless Consent Mode / UET pings;
  • Google limited-ads requests;
  • embedded video players. Their cookies are still classified individually.
• Generic cookie names (sb, SM, UID, MUID…) are matched only on the vendor's domain. Google AEC/SOCS are strictly necessary, and YouTube YSC is functional.
• Unknown cookies are left unclassified for you to confirm. They are never guessed.

FAQ

Is this a compliance certificate? No. It is an indicator tool, not legal advice. Keyword checks can miss wording that is present, or accept wording that is weak. A person must review the results.

Why might the inventory miss cookies? Only the pages visited are scanned. Logged-in areas, checkouts, geo-targeted tags and A/B tests can be missed. If Accept cannot be clicked, cookies that load after consent are missing, and this is flagged.

Does it work for non-English policies? The policy-text checks are English heuristics. The inventory and consent tests work in any language. Button detection covers EN/FR/DE/ES/IT/PT/NL.

Does it bypass bot protection? No. It never solves CAPTCHAs or bypasses protection. Blocked sites are reported as blocked and not charged. Policy pages respect robots.txt for the token SiteVerdict.

Limits

• One location per run (an Apify Proxy country is optional), and one snapshot in time.
• Policies that are PDFs, sit inside iframes, or use JavaScript-only accordions that do not render text may not be extracted.
• About 1–2 minutes per site. The default is 2 sites in parallel at 2 GB.

Compliance & sources

• UK GDPR Art 13/14. ICO, Right to be informed.
• PECR reg 6. ICO, storage and access technologies guidance.
• ICO consent-or-pay guidance (2025) and the ICO's work on making "Reject all" as easy as "Accept all".
• EU ePrivacy Directive Art 5(3). EDPB Cookie Banner Taskforce report (Jan 2023); EDPB Guidelines 2/2023.
• CNIL cookie guidelines (2020).
• Data (Use and Access) Act 2025 (UK).

References were checked against the public sources as of October 2026.

Personal data:

• No personal data about individuals is collected.
• Only cookie names, domains and expiry are recorded; values are never recorded.
• Consent-cookie values are parsed in memory and only the yes/no result is kept.
• Identifiers are redacted from evidence URLs.

Where data is stored and for how long:

• Results, draft cookie policies, cookie inventories (CSV), the HTML report and optional client PDFs go to the run's default dataset and key-value store in your own Apify account. These are unnamed; how long Apify keeps them is set by Apify and your plan, not by SiteVerdict (Apify data retention).
• Monitoring (off by default): a named key-value store siteverdict-policy-monitor-<name> keeps one snapshot per site: risk score, policy URLs, a hash of the policy text (not the text), cookie and tracker names and finding titles. Apify keeps named stores until you delete them.
• Third parties you choose: the optional AI fix sends the check results (not page text) to Anthropic or OpenAI under your own key and their terms; alerts go only to the Slack/webhook URLs you enter.
• What SiteVerdict keeps: nothing. The Actor runs in your Apify account and sends no data to SiteVerdict.
• Private-network protection: private, local and internal addresses are refused, including redirects and every browser request (since 2.0.4).

Built by SiteVerdict (BharatFare Travel and Technologies Ltd, UK). Pairs with the SiteVerdict Cookie Consent & Consent Mode v2 Auditor, which adds the PDF evidence pack, the request timeline and the Consent Mode v2 checklist. Contact: Use the Issues tab on this Actor's Store page.