Honest comparison
Attacat's Cookie Audit Tool is a free bookmarklet from a UK digital agency: drag it to your bookmarks bar, open any page, click it, and it lists the cookies your browser currently holds for that site. It has been a handy first look since the 2012 UK cookie law. It shows your own browser's session on one page at a time; it does not load the page as a first-time visitor, does not separate what fired before the consent click from what fired after, and does not see requests that set no cookie. CookieInspector runs the page in a clean browser, records both phases, and names the tag behind each cookie.
Last reviewed · October 2026
Pick the path that fits
You probably need Attacat Cookie Audit Tool. CookieInspector isn't a CMP — but you can layer us on top for independent audit evidence. See "How to layer CookieInspector on top of Attacat Cookie Audit Tool" below.
Many teams pay for Attacat Cookie Audit Tool just to use the scanner. If you don't need a TCF-certified banner or consent logs, CookieInspector replaces the scanning component at a fraction of the cost.
Free. A bookmarklet; nothing to install beyond dragging it to the bookmarks bar.
Free: 1 full scan per domain, 1 page, summary report. Pro: $9.99/mo billed annually ($11.99/mo monthly) for monitoring, multi-page scans, the How to fix guide and exports. Agency: $39.99/mo.
Where each product focuses, without pretending we do the same job.
| Feature | Attacat Cookie Audit Tool | CookieInspector |
|---|---|---|
| Lists cookies on the current pageYour browser already carries your consent choice and your logged-in state; a first-time visitor's browser does not. | Yes, from your own browser session | Yes, from a clean browser in the US or Germany |
| Before vs after consentThe before-consent list is what regulators and lawsuits look at. | No. One snapshot of whatever is set when you click | Two phases: everything before the click, everything after |
| Which script set each cookieA developer cannot fix "_ga was set" without knowing which tag did it. | No. Name, domain and expiry only | Yes. The tag or script behind each cookie, with the request timeline |
| Trackers that set no cookieServer-side and cookieless tracking never show up in a cookie list. | Not visible | Captured: pixels, beacons and third-party requests, with timestamps |
| Consent banner checkInstalled is not the same as working. | No | 30+ platforms recognised; tests whether rejecting blocks trackers |
| Google Consent Mode v2 | No | Default state, four signals and the update after the click, read off the network |
| Multiple pages and scheduling | One page at a time, by hand | Up to 5 pages per scan; scheduled monitoring with alerts on Pro |
| Report you can hand to someone | Copy the list by hand | PDF, Notion and Confluence exports; a How to fix guide for the developer |
Most teams keep their CMP and add us for evidence, monitoring, and external audit proof.
It is free and instant. Nothing about using CookieInspector asks you to stop.
Paste the URL on cookieinspector.com. The report lists what fired before and after the consent click, from a browser that has never seen the site.
Cookies the bookmarklet shows that the scan puts after the click are fine. Cookies the scan puts before the click are the ones to fix, and the report names the tag that set each.
It is still published on Attacat's site as a free resource. It is a bookmarklet, so it keeps working as long as the browser lets a bookmark run script on the page; it does not depend on a service that could be switched off.
Two reasons. It only sees cookies your browser already has, so anything your consent choice blocked is absent; and it only sees cookies, so trackers that work through requests or local storage never appear. The scan starts from an empty browser and records every request.
Because you accepted the banner at some point, and your browser kept everything that followed. The scan's before-consent list is what a visitor who has not clicked gets; its after-consent list should match what you see.
No. It loads the public page from the outside like a visitor would. Nothing to install, no plugin, no access to the site needed.