Free Cookie Scanner & GDPR
Cookie Compliance Checker
Is your cookie banner putting you at risk of a fine?
Most cookie banners look compliant but fail a real cookie check. Quick Scan shows what fires before consent; Deep Scan tests whether your site actually blocks tracking when users click Reject.
Quick check: cookies, banner & compliance score in ~15 seconds. No signup needed.
Why this matters right now
Cookie consent is the most enforced part of GDPR
The French DPA fined Criteo €40M for dropping tracking cookies before consent. The Spanish DPA fined CaixaBank €6M for the same issue. These aren’t just big-company problems — the average cookie consent fine starts at €10,000 for SMBs.
€4.5B+
GDPR fines issued since 2018
2,000+
Enforcement actions on record
#1
Cookie consent: top enforcement area
30+
Countries with active DPA enforcement
Every finding in your report is scored against published enforcement decisions. You see which issues regulators actually fine for.
Is your site at risk? Check in 15 secondsWhat this cookie checker scans for
Our cookie scanner identifies the issues that cause real GDPR violations — ranked by what regulators actually fine for.
Run a full cookie scan and see exactly where your website fails.
Tracking consultancy
Need your tracking to work after the cookie scan?
CookieRisk can help you move from evidence to implementation. A tracking specialist can audit your consent flow, GTM, GA4 and advertising pixels, then help your team fix and verify the measurement path.
Prioritised recommendations tied to observed browser evidence.
Audit, implementation or a focused second opinion for your team.
What makes this different
Cookie scanner that tests real GDPR compliance
Most tools count cookies. We verify your consent setup actually works.
A deep scan runs three full browser sessions — baseline, reject, and accept — then compares them to prove whether your consent banner enforces user choices. This is the evidence trail that fines are built on.
Baseline
Are you tracking visitors before they consent?
We load your site in a real browser and capture every cookie, tracker, and third-party request that fires before anyone touches the banner. This is the evidence regulators look for first.
Reject flow
Does clicking Reject actually stop anything?
The scanner clicks your Reject button and records what changes. If trackers keep firing, you have a possible consent issue that needs review.
Accept flow
Which vendors ignore consent entirely?
We click Accept and compare the difference. This three-way comparison reveals which vendors respect user choices and which track regardless of what visitors click.
Verdicts
Per-vendor proof for your lawyer or DPO
Every vendor gets a verdict: pass, fail, or warning. Each finding is backed by evidence — request URLs, cookie names, and timing data. Ready for legal review or audit.
Risk scoring
Know which issues DPAs are actively fining for
Findings are ranked using data from published enforcement decisions across 30+ countries, so you fix the issues that carry real regulatory risk first.
Run a cookie scan in seconds
Quick Scan needs no signup. Deep Scan is free with an account. No code to install.
Paste any URL — takes 2 seconds
Enter a website URL. We load it in a real Chromium browser — the same engine your visitors use. No browser extensions, no code snippets, nothing to install on your site.
See the violations regulators see
Get a full evidence report: every cookie, tracker, and third-party request — plus whether your banner actually stops tracking when visitors say no. Quick scan in ~15 seconds. Deep scan with consent verification in ~90 seconds.
Fix the issues that trigger fines — before regulators find them
Findings are scored using real enforcement patterns from 30+ countries. You see which issues carry the highest regulatory risk, with clear fix guidance for each one. No guesswork.
From cookie scan to compliance proof
Every finding is backed by evidence. Every risk is connected to real enforcement patterns. This isn’t a cookie count — it’s compliance proof.
Proof of tracking before consent
See exactly which cookies and trackers fire before anyone interacts with the banner. Pre-consent tracking is the #1 issue regulators fine for — documented per request with timestamps.
Know if your banner has dark patterns regulators flag
Identifies your consent platform (Cookiebot, OneTrust, Didomi, etc.), checks for dark patterns, accessibility issues, and Google Consent Mode v2 configuration.
Evidence your consent flow works — for auditors and lawyers
Deep Scan clicks Reject and Accept in separate sessions, then diffs the results. Per-vendor verdicts show which trackers respect consent and which ignore it — ready for legal review.
A single score so you know exactly where you stand
A transparent 0-100 compliance score with clear deductions for each issue found. No black box — you see exactly what lowered your score and by how much.
Catch fingerprinting and CNAME cloaking before the DPA does
Detects fingerprint APIs, CNAME cloaking, server-side tagging, and other advanced tracking techniques that bypass traditional cookie controls.
See which issues DPAs are currently fining companies for
Findings are prioritised using patterns from published enforcement decisions across 30+ countries. You fix the issues that carry real regulatory risk first.
Simple pricing for cookie compliance monitoring
Free includes scheduled monitoring and Deep Scan for one site. Paid plans add more sites, history, alerts, team access, and reporting features.
Paid plans start at €49/month for more sites, alerts, history, and reporting.
Free
Quick Scan without signup; Deep Scan with a free account
Pro
For businesses that need continuous website monitoring, alerts, and evidence history.
or €468/year (save 20%)
7-day free trial
Agency
For agencies managing client websites, reporting, white-label delivery, and multi-client operations.
or €1428/year (save 20%)
7-day free trial
DPO add-on
Add governance and DPO workflows to Pro or Agency: processing register, vendor DPAs, DPIAs, DSAR, legal risk, evidence packages, and accountability workflows.
Try Pro or Agency for 14 days. If the scanner doesn’t find at least one compliance issue you didn’t know about, we’ll refund you — no questions asked.
Payments processed securely by Mollie. Supports iDEAL, credit cards, SEPA Direct Debit, and more European payment methods. Cancel anytime.
Common questions about cookie compliance
Everything businesses ask before their first scan.
Use a cookie checker that tests real behaviour, not just whether a banner exists. Quick Scan loads your site in a real browser and captures pre-consent tracking. Deep Scan clicks Reject and measures what actually changes. If trackers keep firing after Reject, you have a possible consent issue that needs review.
GDPR fines can reach up to 4% of annual global turnover or €20M, whichever is higher. In practice, cookie consent fines for small and mid-sized businesses range from €10,000 to €500,000 depending on the severity, the number of affected users, and the DPA handling the case. Beyond fines, there’s the cost of legal defence, reputation damage, and mandatory remediation.
No. Many CMPs are misconfigured. Having Cookiebot or OneTrust installed doesn’t mean it’s working correctly. Quick Scan checks whether trackers fire before consent; Deep Scan verifies whether they stop when users click Reject. Many sites pass a visual check but fail the technical one.
Every finding in your report comes with clear fix guidance and a priority ranking based on real enforcement patterns. You’ll know exactly what to fix first (the issues regulators actually fine for) and how to fix it. For ongoing protection, monitoring plans alert you the moment something breaks so you can fix it before it becomes a complaint.
A Quick Scan loads your page without clicking anything and captures all cookies, trackers, third-party requests, banner presence, and a compliance score — in ~15 seconds. A Deep Scan runs three full browser sessions (baseline, reject, accept), compares them, and generates per-vendor consent verdicts with evidence. It takes ~60–90 seconds and proves whether your cookie banner actually enforces user choices.
Quick Scan runs directly from the homepage without creating an account. Deep Scan is free too, but requires a free account because it queues a longer consent-verification run and stores the evidence report in your workspace.
We store scan results (cookies found, trackers detected, compliance scores) so you can access your reports. We do not store any personal data from the websites you scan. Scan results are retained based on your plan (7 days for free, 90 days for Pro, 1 year for Agency). You can delete your data at any time from the dashboard.
The scanner checks against requirements from GDPR (EU), the ePrivacy Directive, CCPA/CPRA (California), PECR (UK), and LGPD (Brazil). Risk scoring uses enforcement data from European DPAs to provide country-specific context. The evidence reports are designed to be useful for legal review, DPO audits, and regulatory inquiries.
Free quick cookie compliance check
See exactly what fires before consent, then use Deep Scan to verify whether Reject actually stops tracking. Quick Scan needs no signup. Deep Scan is free with an account.
Start your free cookie scanThe average site has 7 pre-consent tracking violations. What’s your number?