Find cookies & trackers your site sets (no click / Reject / Accept) and check them against your cookie & privacy policies: missing cookies, UK GDPR Art 13/14 gaps, ICO/PECR consent issues. Generates a DRAFT cookie table & cookie policy. Not legal advice.
Security: proxy input. Only the proxy settings the input form offers are accepted: Apify Proxy, or custom proxy URLs starting with http:// or https://. Other proxy options (for example tieredProxyUrls) and SOCKS proxies are refused before anything is loaded, with a clear message; nothing is charged. Previously a proxy given as tieredProxyUrls skipped the private-network check.
Security: https proxies. A custom https:// proxy is now connected to over TLS (certificate checked, default port 443), so your proxy password is never sent in clear text.
Only Apify's own proxy host is trusted without a check (was: any *.apify.com name). Redirects followed by the built-in HTTP client no longer carry credentials to another site.
No change to outputs or pricing.
The robots.txt / policy-probe user agent now points to this Actor's public Apify Store page instead of an e-mail address (bot name unchanged).
2.0.8 (2026-10-16) — Custom proxy pinning
When you use your own proxy (Apify Proxy or custom proxy URLs), the browser now goes through a local checking proxy chained to your proxy, instead of connecting to your proxy directly. Every address the site loads is checked there, and the connection to your proxy is made to exactly the address that was checked, so a proxy host name that later points to a private or internal address is refused. No change to inputs, outputs or pricing.
Memory default (15 Oct 2026)
Clearer refusals: a start URL that redirects to a private/internal address is reported as blocked ("refused ... not charged") and counted as blocked; start URLs skipped as invalid (for example IPv6 literals) are now reported in the log.
15 Oct 2026 (build after this entry): default run memory is now 2048 MB via defaultMemoryMbytes (the old defaultRunOptions 2048 MB was ignored so runs used 4096 MB; peak 270-537 MB). Measured on the example input: same output, see the public-15 remediation log. You can still choose more memory per run. No change to inputs, outputs or pricing.
Security: private, local and internal addresses are refused. Start URLs and policy URLs that point to localhost, 127.0.0.1, private ranges (10.x, 172.16-31.x, 192.168.x), link-local, CGNAT, the cloud metadata address 169.254.169.254, IPv6 loopback/unique-local, IPv4-mapped IPv6, or decimal/octal/hex IP forms are refused before anything is loaded, with a clear message. Nothing is charged for a refused site. Names that resolve to such addresses are refused too.
Browser traffic is checked on every request, not only the first page. Without your own proxy, Chromium sends every request (page loads, redirects, images, scripts, iframes, fetch/XHR, WebSockets) through a local checking proxy that resolves each host once, refuses private answers and connects to exactly the checked address, so DNS rebinding cannot switch the target after the check. With your own proxy (Apify Proxy or custom URLs), every request is checked by request interception instead.
robots.txt reads and policy-page probes use the same pinned client and re-check every redirect hop; alert webhooks are sent with it too.
Shared SiteVerdict consent engine v2.0 (same as the Consent Auditor):
Reject/Accept read-back from the CMP and confidence on every finding ("check manually" items are not scored);
wrong-click guards and late-banner wait;
closed shadow DOM banners;
consent-or-pay detection;
bot-protection pages reported as blocked (not charged);
Google CMP and Transcend support.
Fix: "after Reject" double counting. It now counts only cookies/storage that are new after the click. Previously, a cookie set before consent and still present after Reject was also reported as "after Reject" (critical).
Fix: what counts as a tracker firing. These no longer count: library downloads (incl. session-replay scripts), cookieless Consent Mode / UET pings, Google limited-ads requests, and embedded video players.
Fix: generic cookie names.sb, SM, UID, MUID, bcookie… are only matched on the vendor's domain. Google AEC / SOCS are strictly necessary. YouTube YSC is functional.
New: client report (clientReport). White-label HTML + PDF per site with a first-visit screenshot. Event client-report.
New: monitoring mode. Detects:
policy text changes (hash only, the text is not stored);
policy URL and "last updated" changes;
new cookies not in the policy;
new cookies before consent;
new/resolved issues.
New: alerts to Slack / HTTPS webhook (event alert-sent).
New: AI-drafted policy wording with the user's own Anthropic / OpenAI key (event ai-fix-generated). Uses placeholders for anything not observed; DRAFT, not legal advice.
1.0 (11 Oct 2026)
First release.
Cookie and storage inventory across three consent scenarios: no click, Reject, Accept.
Covers cookies, localStorage, sessionStorage and third-party tags.
Each item gets a purpose category, provider, party, expiry and its consent state.
Policy discovery. Finds policy links in the footer, header and cookie banner, links from the privacy notice, and common paths (robots.txt respected).
Layered/hub notices are expanded with up to 8 sub-pages.
Short cookie pages are expanded with their "detailed cookie information" page.
Policy checks:
UK GDPR Art 13/14 privacy-notice elements, with evidence quotes and section headings.
Cookie-policy elements.
Inventory ↔ policy matching, at three levels: name, name pattern, provider.
Providers that are observed but not named, and providers that are named but not observed.
ICO/PECR consent indicators:
non-essential cookies before consent
tracking after Reject
no first-layer Reject
consent-or-pay
functional or unrecognised cookies set before consent
EU ePrivacy notes.
DRAFT outputs. A cookie-policy template (Markdown + HTML), a cookie table (Markdown) and the inventory (CSV), all clearly marked "DRAFT – not legal advice".
Pay-per-event pricing:site-checked and draft-generated. The run stops at the user's maximum total charge, and failed or empty work is never charged.
Detection logic for vendors, CMPs and cookies is copied from the SiteVerdict Tracking & Consent Auditor, with added functional vendors (Intercom, Zendesk, tawk.to, Stripe, reCAPTCHA, Contentsquare, SpeedCurve, Klaviyo).
