Scan your website’s cookies, and see which ones break consent

What a cookie scanner does

A cookie scanner (or cookie checker) opens your pages in a browser and records what lands on the visitor’s device: cookies, local storage and the requests that go out to other companies. The result is a list you can use to fill in your cookie policy and to spot tools you forgot about.

A list alone doesn’t tell you if you follow the law. Article 5(3) of the ePrivacy Directive and the UK’s PECR say anything that isn’t strictly necessary needs consent first. So the question isn’t only “which cookies do we have?” but “which ones arrive before a choice, or after a no?”.

It isn’t only cookies, either. The European Data Protection Board’s Guidelines 2/2023 say local storage, tracking pixels and similar techniques are covered too. A good scan looks at all of them.

Check your cookies by hand in 5 minutes

You don’t need any tool to start. In Chrome or Edge:

1. Start fresh: Open your site in a private (incognito) window, so no earlier choice is stored. Don’t touch the banner yet.
2. Open the cookie list: Press F12 (Cmd+Option+I on a Mac), go to Application, then Storage, then Cookies, and pick your site. Chrome’s DevTools guide explains each column. In Firefox the same list is under the Storage tab.
3. Write down what’s there: For each cookie, note the Name, the Domain and the Expires / Max-Age column. Check Local storage just below, too.
4. Look at the network: Open the Network tab, tick “Preserve log” and reload. Type google-analytics, doubleclick, facebook, tiktok, clarity and hotjar into the filter one at a time.
5. Click “Reject” and reload: Use your banner’s own reject button, then reload the page and repeat steps 2 to 4. Compare the two lists.

Anything for analytics or ads that shows up before step 5, or again after it, is a problem. To test the rest of the banner (button design, pre-ticked boxes, Google’s consent signals), follow our 10-minute cookie banner check.

Why the scan has to click “Reject”

Many cookie scanners crawl your site, list what they find and stop there. That’s useful for a cookie policy, but it can’t tell you whether your tags wait for consent. The problems that get sites in trouble only show up when you look at the timing:

• Before a choice: Analytics or ad cookies set the moment the page opens. See tracking before consent.
• After “Reject”: Trackers that keep running after the visitor said no. See tracking after reject.
• On the next page: A refusal that’s forgotten as soon as the visitor clicks on. See reject not remembered.

Our cookie banner fines tracker lists real cases, and most of them hit sites that had a banner. The banner existed; it just didn’t stop anything.

How to read the results

• First party or third party: A first-party cookie belongs to your own domain; a third-party one belongs to another company’s domain, such as an ad network. First party doesn’t mean harmless: Google Analytics sets its _ga cookie on your own domain, and it still needs consent.
• Lifetime: Session cookies go when the browser closes; others stay until the date in Expires / Max-Age. Google says _ga lasts two years by default. France’s regulator, the CNIL, recommends a 13-month limit for audience-measurement trackers. See long-lived cookies.
• Category: Most consent tools sort cookies into strictly necessary, preferences, statistics and marketing. Only the strictly necessary group (login, cart, security and the cookie that stores the visitor’s choice) can load without consent. Not sure where a tool fits? Our post Do I need a cookie banner? goes through 12 common ones.
• Who set it: Cookie names like _ga, _fbp or _clck point to Google Analytics, Meta and Microsoft Clarity. When a name means nothing to you, search for it along with the domain.

What to fix first

1. Remove tools you no longer use. Every script you drop is one less thing to ask consent for.
2. Make analytics and ad tags wait for consent. In Google Tag Manager, that means consent settings on each tag. If you use Google tags, read basic vs advanced Consent Mode and check yours with the Consent Mode v2 checker.
3. Make “Reject” really stop them, then re-test with the “Reject all” test.
4. Store the visitor’s choice so it applies on every page.
5. Shorten long cookie lifetimes, and update your cookie policy to match what the scan found.

Watch the banner itself too: a reject button that’s harder to find than “Accept” is a dark pattern regulators act on.

Run a free real-browser scan

untick does the manual check for you. It loads your homepage in a real browser as a new visitor, records every request and tracking cookie, clicks your banner’s own “Reject” button, reloads and records again. You get the tracking cookies it saw with their domain and lifetime, screenshots, and a fix for each problem.

The free scan covers your homepage and the states it could complete. It can’t see pages behind a login, server-side tracking or every country and device, so treat a clean result as a clean homepage, not a clean business. How a scan works explains the limits.

Running a shop? The store test adds pre-ticked boxes, the EU withdrawal button and accessibility to the same scan.