Tracking Cookies Scan

1. Paste the address of the page you want to check, usually your home page, and start the scan. The quick check runs right away with no account: it reads the page's HTML and headers and names the consent platform, the known trackers and whether Google Consent Mode is present.

2. Open a free account for the full scan. A real Chromium browser loads the page as a first-time visitor from the United States or Germany, records every cookie and request before anyone touches the banner, then accepts and records what loads after.

3. Read the report: each tracking cookie with its name, domain, lifetime and the tag or script that set it, split into what loaded before consent and after it. Your first site's full scan is free.

A tracking cookie identifies a browser across visits or across sites for analytics or advertising. The ones a scan finds most often: _ga and _ga_* (Google Analytics), _gcl_au (Google Ads), _fbp (Meta Pixel), _ttp (TikTok), li_sugr (LinkedIn), _uetsid and _uetvid (Microsoft Ads), _clck (Microsoft Clarity), _hjSessionUser (Hotjar) and IDE on doubleclick.net.

Strictly necessary cookies such as a session, a CSRF token or Cloudflare's __cf_bm are not tracking cookies and are not flagged. Cookieless analytics such as Plausible or Cloudflare Web Analytics are listed with their own label and do not count against the site.

Under GDPR and the ePrivacy rules, a tracking cookie needs the visitor's consent before it is set. A list of every cookie on a site does not answer that; the order does. The scan records what loaded in the first seconds, before the banner was even answered, separately from what loaded after the visitor accepted.

Some trackers send data without setting a cookie at all, like a pixel request to facebook.com or a Google Ads conversion ping. The scan counts those third-party requests too, because they need the same consent.

Most tracking cookies are not added by developers. They come from a tag manager container, a marketing plugin, a chat widget or an embedded video. The report names the script behind each cookie so you know whether to fix the tag, the plugin or the consent platform's settings.

It works alongside whatever consent platform you use, Cookiebot, CookieYes, OneTrust, Complianz or a custom banner, and checks that it blocks what it is configured to block.

Each report comes with a How-to-fix guide for that site: which tags to gate behind consent and how, as a PDF for your developer or as Markdown you can paste into an AI coding agent.

Tracking cookies come back when someone adds a tag. Monitoring re-runs the scan on a schedule and emails you when something new loads before consent.