# GDPR Cookie Scanner: Consent Checker, Trackers & Google Fonts (`tidelane/gdpr-cookie-scanner`) Actor

Scan websites like a first-time visitor who has not clicked the cookie banner: cookies set, trackers loaded (Google Analytics, Tag Manager, Meta Pixel, Hotjar …), Google Fonts, YouTube and Maps embeds, consent tool used. Clear findings and a risk level per page for GDPR and ePrivacy compliance.

- **URL**: https://apify.com/tidelane/gdpr-cookie-scanner.md
- **Developed by:** [Tidelane Data](https://apify.com/tidelane) (community)
- **Categories:** SEO tools, Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.38 / 1,000 page scanneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## GDPR Cookie Scanner: Consent Checker, Trackers & Google Fonts

Find out what a web page does **before the visitor clicks the cookie banner**. The Actor opens each page in a fresh browser without cookies, does not touch the consent banner, and records every **cookie**, every **third-party service** (analytics, ads, session recording, social, video, maps, fonts, CDNs) and the **consent tool** in use. You get a clear list of **findings** with a risk level per page.

Under the GDPR and the German TTDSG / TDDDG, tracking cookies and most third-party services need consent first. Loading them before consent is one of the most common reasons for complaints and warning letters, and Google Fonts loaded from Google servers have been fined by German courts.

- ✅ **Real browser**: pages run with JavaScript, so tag managers and pixels fire as they do for real visitors
- ✅ **Cookies classified**: name, domain, first or third party, service (Google Analytics, Meta Pixel, Hotjar, ...), category, lifetime in days
- ✅ **Services before consent**: about 90 well-known trackers, ad networks, session recorders, fonts, video, maps and CDNs
- ✅ **Consent tool detection**: Cookiebot, OneTrust, Usercentrics, Sourcepoint, Didomi, consentmanager, Borlabs, Complianz, Klaro and more, plus the IAB TCF API
- ✅ **Findings with risk level**: `high`, `medium` or `low` per page, ready for a report or a client email
- ✅ **Bulk**: scan a whole list of pages or client sites in one run
- ✅ **Fair billing**: per scanned page; pages that fail to load and pages excluded by robots.txt are free

### Input example

```json
{
    "urls": ["https://books.toscrape.com", "https://example.com"],
    "waitAfterLoadSecs": 5,
    "proxyConfiguration": { "useApifyProxy": false }
}
```

Consent tools often show different banners by country. To see what an EU visitor gets, set `proxyConfiguration` to Apify Proxy with an EU country. Which countries you can use depends on your Apify proxy plan. Without a proxy the page is loaded from the Apify server location; `visitorRegion` in each result tells you which one was used.

### Output example

Real output from a test run:

```json
{
    "url": "https://books.toscrape.com/",
    "finalUrl": "https://books.toscrape.com/",
    "statusCode": 200,
    "site": "toscrape.com",
    "risk": "low",
    "findings": [
        {
            "code": "external_cdn",
            "severity": "low",
            "message": "Scripts or styles load from public CDNs, which receive the visitor IP. Hosting these files yourself avoids the transfer.",
            "items": ["Google Hosted Libraries"]
        }
    ],
    "consentTools": [],
    "tcfApi": false,
    "trackersBeforeConsent": [],
    "cookieCount": 0,
    "trackingCookieCount": 0,
    "thirdPartyCookieCount": 0,
    "cookies": [],
    "thirdParties": [
        {
            "service": "Google Hosted Libraries",
            "category": "cdn",
            "domains": ["ajax.googleapis.com"],
            "requests": 1,
            "resourceTypes": ["script"],
            "needsConsent": false
        }
    ],
    "requestCount": 31,
    "visitorRegion": "no proxy (Apify server location)",
    "checkedAt": "2026-10-20T23:00:38.112Z"
}
```

Each cookie in `cookies` looks like this:

```json
{ "name": "_ga", "domain": "example.org", "firstParty": true, "service": "Google Analytics", "category": "analytics", "tracking": true, "expiresDays": 400, "secure": false, "httpOnly": false, "sameSite": "Lax" }
```

### Findings

| Code | Severity | Meaning |
|---|---|---|
| `trackers_before_consent` | high | Analytics, ads, session recording or social trackers load before consent |
| `tracking_cookies_before_consent` | high | Tracking cookies (for example `_ga`, `_fbp`, `_hjSession`) are set before consent |
| `google_fonts_external` | medium | Google Fonts load from Google servers (see LG München I, 3 O 17493/20) |
| `youtube_embed` | medium | YouTube content loads before consent |
| `maps_embed` | medium | Google Maps loads before consent |
| `no_consent_tool` | medium | Services that need consent are used, but no consent tool was found |
| `external_cdn` | low | Files load from public CDNs that receive the visitor IP |
| `third_party_cookies` | low | Cookies are set under other domains |

`risk` is `high` when there is a high finding, `medium` when there is a medium one, otherwise `low`.

### Pricing

A fixed price per scanned page. In our test 3 pages took 30 seconds with the default 2 GB memory.

Paid Apify plans pay less: 10% off on Starter, 20% on Scale and 30% on Business and higher plans.

### FAQ

**Does the Actor click "Accept" or "Reject"?** No. It shows the state before any choice, which is the state the law cares about most. Everything that loads then loads without consent.

**Is a `low` result proof that my site is compliant?** No. The scan checks the most common technical problems on the pages you give it. It does not check your privacy policy, the banner's wording or what happens after consent. It is not legal advice.

**Why is a service missing?** The list covers about 90 widely used services. Unknown third parties still appear in `thirdParties` with their domains, just without a service name.

**Why is a page "blocked_by_robots"?** By default robots.txt is respected. Turn it off only for your own sites or with the owner's permission.

### More tools from Tidelane Data

- [Tech Stack Detector](https://apify.com/tidelane/tech-stack-detector): CMS, frameworks and technologies of any website
- [Accessibility Checker](https://apify.com/tidelane/accessibility-checker): WCAG 2.2, EAA and ADA audits with axe-core
- [Website Screenshot API](https://apify.com/tidelane/website-screenshots): full-page and mobile screenshots without cookie banners
- [SEO Audit](https://apify.com/tidelane/seo-audit): on-page SEO checks for any list of URLs

All our tools: [apify.com/tidelane](https://apify.com/tidelane)

***

#### Impressum

Levi Griesinger, Tidelane Data\
Besigheimer Straße 18\
74369, Löchgau, Deutschland\
E-Mail: LeviGriesinger@gmail.com

# Actor input Schema

## `urls` (type: `array`):

Pages to scan, one per line. Each page is opened in a fresh browser without cookies and without clicking the consent banner.

## `waitAfterLoadSecs` (type: `integer`):

Time to wait after the page has loaded, so tag managers can fire their tags.

## `proxyConfiguration` (type: `object`):

Many consent tools behave differently by country. To see what an EU visitor gets, use Apify Proxy with an EU country (available countries depend on your Apify proxy plan). Without a proxy the page is loaded from the Apify server location.

## `respectRobotsTxt` (type: `boolean`):

Skip pages that robots.txt forbids. Turn off only for your own sites.

## `maxConcurrency` (type: `integer`):

Pages scanned at the same time.

## `timeoutSecs` (type: `integer`):

How long to wait for a page to load.

## Actor input object example

```json
{
  "urls": [
    "https://books.toscrape.com"
  ],
  "waitAfterLoadSecs": 5,
  "proxyConfiguration": {
    "useApifyProxy": false
  },
  "respectRobotsTxt": true,
  "maxConcurrency": 3,
  "timeoutSecs": 45
}
```

# Actor output Schema

## `results` (type: `string`):

All results of the run as dataset items.

## `summary` (type: `string`):

Summary per input with status (ok, error and the reason).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://books.toscrape.com"
    ],
    "proxyConfiguration": {
        "useApifyProxy": false
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("tidelane/gdpr-cookie-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "urls": ["https://books.toscrape.com"],
    "proxyConfiguration": { "useApifyProxy": False },
}

# Run the Actor and wait for it to finish
run = client.actor("tidelane/gdpr-cookie-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://books.toscrape.com"
  ],
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}' |
apify call tidelane/gdpr-cookie-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,tidelane/gdpr-cookie-scanner"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/CQkcZDwJeKajEUJaP/builds/SjAkl41hiHppTtjCb/openapi.json