GDPR Cookie Scanner: Consent Checker, Trackers & Google Fonts

Find out what a web page does before the visitor clicks the cookie banner. The Actor opens each page in a fresh browser without cookies, does not touch the consent banner, and records every cookie, every third-party service (analytics, ads, session recording, social, video, maps, fonts, CDNs) and the consent tool in use. You get a clear list of findings with a risk level per page.

Under the GDPR and the German TTDSG / TDDDG, tracking cookies and most third-party services need consent first. Loading them before consent is one of the most common reasons for complaints and warning letters, and Google Fonts loaded from Google servers have been fined by German courts.

• ✅ Real browser: pages run with JavaScript, so tag managers and pixels fire as they do for real visitors
• ✅ Cookies classified: name, domain, first or third party, service (Google Analytics, Meta Pixel, Hotjar, ...), category, lifetime in days
• ✅ Services before consent: about 90 well-known trackers, ad networks, session recorders, fonts, video, maps and CDNs
• ✅ Consent tool detection: Cookiebot, OneTrust, Usercentrics, Sourcepoint, Didomi, consentmanager, Borlabs, Complianz, Klaro and more, plus the IAB TCF API
• ✅ Findings with risk level: high, medium or low per page, ready for a report or a client email
• ✅ Bulk: scan a whole list of pages or client sites in one run
• ✅ Fair billing: per scanned page; pages that fail to load and pages excluded by robots.txt are free

Input example

{
    "urls": ["https://books.toscrape.com", "https://example.com"],
    "waitAfterLoadSecs": 5,
    "proxyConfiguration": { "useApifyProxy": false }
}

Consent tools often show different banners by country. To see what an EU visitor gets, set proxyConfiguration to Apify Proxy with an EU country. Which countries you can use depends on your Apify proxy plan. Without a proxy the page is loaded from the Apify server location; visitorRegion in each result tells you which one was used.

Output example

Real output from a test run:

{
    "url": "https://books.toscrape.com/",
    "finalUrl": "https://books.toscrape.com/",
    "statusCode": 200,
    "site": "toscrape.com",
    "risk": "low",
    "findings": [
        {
            "code": "external_cdn",
            "severity": "low",
            "message": "Scripts or styles load from public CDNs, which receive the visitor IP. Hosting these files yourself avoids the transfer.",
            "items": ["Google Hosted Libraries"]
        }
    ],
    "consentTools": [],
    "tcfApi": false,
    "trackersBeforeConsent": [],
    "cookieCount": 0,
    "trackingCookieCount": 0,
    "thirdPartyCookieCount": 0,
    "cookies": [],
    "thirdParties": [
        {
            "service": "Google Hosted Libraries",
            "category": "cdn",
            "domains": ["ajax.googleapis.com"],
            "requests": 1,
            "resourceTypes": ["script"],
            "needsConsent": false
        }
    ],
    "requestCount": 31,
    "visitorRegion": "no proxy (Apify server location)",
    "checkedAt": "2026-10-20T23:00:38.112Z"
}

Each cookie in cookies looks like this:

{ "name": "_ga", "domain": "example.org", "firstParty": true, "service": "Google Analytics", "category": "analytics", "tracking": true, "expiresDays": 400, "secure": false, "httpOnly": false, "sameSite": "Lax" }

Findings

Code	Severity	Meaning
trackers_before_consent	high	Analytics, ads, session recording or social trackers load before consent
tracking_cookies_before_consent	high	Tracking cookies (for example _ga, _fbp, _hjSession) are set before consent
google_fonts_external	medium	Google Fonts load from Google servers (see LG München I, 3 O 17493/20)
youtube_embed	medium	YouTube content loads before consent
maps_embed	medium	Google Maps loads before consent
no_consent_tool	medium	Services that need consent are used, but no consent tool was found
external_cdn	low	Files load from public CDNs that receive the visitor IP
third_party_cookies	low	Cookies are set under other domains

risk is high when there is a high finding, medium when there is a medium one, otherwise low.

Pricing

A fixed price per scanned page. In our test 3 pages took 30 seconds with the default 2 GB memory.

Paid Apify plans pay less: 10% off on Starter, 20% on Scale and 30% on Business and higher plans.

FAQ

Does the Actor click "Accept" or "Reject"? No. It shows the state before any choice, which is the state the law cares about most. Everything that loads then loads without consent.

Is a low result proof that my site is compliant? No. The scan checks the most common technical problems on the pages you give it. It does not check your privacy policy, the banner's wording or what happens after consent. It is not legal advice.

Why is a service missing? The list covers about 90 widely used services. Unknown third parties still appear in thirdParties with their domains, just without a service name.

Why is a page "blocked_by_robots"? By default robots.txt is respected. Turn it off only for your own sites or with the owner's permission.

More tools from Tidelane Data

• Tech Stack Detector: CMS, frameworks and technologies of any website
• Accessibility Checker: WCAG 2.2, EAA and ADA audits with axe-core
• Website Screenshot API: full-page and mobile screenshots without cookie banners
• SEO Audit: on-page SEO checks for any list of URLs

All our tools: apify.com/tidelane

---

Impressum

Levi Griesinger, Tidelane Data
Besigheimer Straße 18
74369, Löchgau, Deutschland
E-Mail: LeviGriesinger@gmail.com