Cookie Checker: Scan Website Cookies Before Consent
Check website cookies the way a GDPR audit does: we load the page in a real browser, never touch the consent banner, and list every cookie, localStorage key and tracker that shows up before the visitor says yes.
Looking for Secure, HttpOnly and SameSite grades of the server's Set-Cookie headers? Use the Cookie Audit.
What a pre-consent cookie scan shows
- Every cookie, not just the server's. Google Analytics, Meta Pixel, LinkedIn Insight and most other tags set their cookies from JavaScript. A header check never sees them; a browser does.
- Owner and category. Each cookie is matched against the Open Cookie Database: necessary, functional, analytics, marketing, or unknown.
- Trackers before consent. Cookies, localStorage keys and requests that give away a tracker, counted before any click on the banner.
- Security flags. Secure, HttpOnly and SameSite for every cookie, which consent-platform scanners leave out.
Frequently asked questions
What does a cookie checker check?
It loads your website the way a first-time visitor sees it and lists every cookie and localStorage key the page stores before anyone answers the consent banner: who sets each one, what for, and how long it lives. Anything in the analytics or marketing categories at that point is a GDPR problem.
Which cookies are allowed before consent under GDPR?
Only strictly necessary ones: session, load balancing, security, and the cookie that records the consent choice itself. Analytics, advertising and personalisation cookies need an opt-in first under the ePrivacy Directive and GDPR, and so do the same identifiers kept in localStorage.
How does this cookie scanner work?
A headless Chrome opens the page in a fresh profile, waits for scripts and tag managers to run, and never clicks the banner. Then we read every cookie from the browser itself, first- and third-party, including those set by JavaScript, plus localStorage and sessionStorage keys and the third-party hosts the page called.
Where do the cookie categories come from?
From the Open Cookie Database, an open list of a few thousand known cookie names with owner, purpose and retention. A cookie it does not know is shown as Unknown rather than guessed.
Why is a cookie I know about missing?
We scan the home page once, from Europe, with no clicks. Cookies set on other pages, after a login, or only for visitors from other countries will not show up. Scan the exact page if it matters.
How is this different from the Cookie Audit?
The Cookie Audit reads the Set-Cookie headers of the server response and grades their Secure, HttpOnly and SameSite flags. The scanner runs the page in a browser and also sees cookies set by scripts and third parties. Both show the flags.