Cookie scan
Our server opens your page as a complete stranger would: no cookies, no button clicked in any banner. Then it lists the cookies that showed up anyway and the outside services that are already loading.
The rule behind every cookie banner
A cookie is a small labeled value that a site asks the browser to keep and send back on later visits. It’s how a shop remembers your cart. It’s also how an advertising network recognizes the same person across thousands of sites.
In the European Union and the United Kingdom, the ePrivacy rules (the UK version is known as PECR) say that storing or reading anything on a visitor’s device needs consent first, unless it’s strictly necessary for the service the person asked for. The GDPR then spells out what consent is: a clear action, taken freely, for a stated purpose, and as easy to withdraw as to give. A box that comes already ticked doesn’t count, and neither does carrying on scrolling.
Other places go about it differently. Several US states, California first, let analytics and advertising run by default but give people a right to opt out, including through the Global Privacy Control signal sent by the browser. In both models the moment of first arrival matters, and that’s the moment this scan looks at.
What the scan reads
- Cookies sent by the server. Every
Set-Cookieheader along the redirect chain, with its lifetime. Names are sorted into three groups: known trackers (_ga,_gid,_fbp,_hjSessionUser,_clck,hubspotutk…), cookies a site needs to work (PHPSESSID,csrftoken,__cf_bm, carts, language, the banner’s own memory), and unknown ones. For an unknown name, the scan goes looking for your privacy policy and checks whether the cookie is described there. - Outside services in the HTML. Script addresses, inline snippets such as
gtag('config', 'G-…')orfbq('init'), iframes, stylesheets,preconnecthints and images are compared with a list of about forty services. - Signs of blocking. A script written with
type="text/plain", or an iframe that keeps its address indata-src, does nothing until a consent tool rewrites it. These are marked “Waits for consent”. - The consent tool. More than twenty are recognized by name, among them Cookiebot, OneTrust, CookieYes, Complianz, Didomi, Usercentrics, iubenda and Klaro, plus homemade banners with accept and reject buttons.
How each line is judged
| What loads on arrival | Mark | Reason |
|---|---|---|
| Analytics (Google Analytics, Tag Manager, Hotjar, Clarity, HubSpot) | Red | Built to identify and follow a visitor. |
| Advertising (Meta Pixel, Google Ads, LinkedIn, TikTok, ad networks) | Red | Same, shared across sites. |
A tracking cookie in a Set-Cookie header | Red | Stored before the page is even drawn. |
| Embedded video, map or social widget; web fonts; live chat | Yellow | The provider receives the visitor’s IP address and may set cookies. |
CAPTCHA, public script CDN, youtube-nocookie.com | Note | Listed so the picture is complete. |
One red line turns the whole result red. Two cases are softened to yellow, because the script loads but may be holding back: Google tags when the page declares Consent Mode with analytics_storage or ad_storage set to denied, and any tracker when Cookiebot runs in automatic blocking mode.
Making trackers wait for a yes
Every consent tool uses the same trick. The tag stays in the page in a form the browser ignores, and the tool switches it on after the click.
<script type="text/plain" data-category="analytics"
src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>The attribute name changes from one tool to the next (data-cookieconsent, data-category, data-service). If your tags live inside Google Tag Manager, set each one to fire on your banner’s consent event instead of “All Pages”. For the yellow lines, serve font files from your own domain, replace video players with a click-to-load preview, and start the chat widget when someone presses the chat button.
The scan doesn’t run JavaScript. It sees a tracker’s script tag, but not the cookies that script would write, and not what a tag manager injects later. Many sites also show a different banner depending on the country, and our server only sees one version. For the complete picture, open the page in a private window with the developer tools on the Network and Application tabs. This is a technical reading, not legal advice.
Questions people ask
Do I need a cookie banner on my website?
Only if the site stores or reads something that isn’t strictly necessary, and has visitors in a place that requires consent, such as the EU or the UK. A site with a session cookie and no analytics, ads or embeds doesn’t need a banner.
Which cookies do not need consent?
The ones the requested service can’t work without: login sessions, shopping carts, security tokens, load balancing, a language choice, and the cookie that records the answer to the banner. Analytics and advertising cookies aren’t in that group.
Can I use Google Analytics without consent?
Not in the EU or the UK in its standard setup, because it writes the _ga cookie. With Consent Mode set to denied it sends cookieless pings instead, and regulators are divided on those. Some authorities exempt narrowly configured audience tools, so check the rules of the country you serve.
Do Google Fonts require consent?
Google Fonts set no cookie, but each visit sends the visitor’s IP address to Google. A Munich court ruled against a site owner for this in January 2022. Host the font files on your own server and the question goes away.
Why does the scan find no cookies when my browser shows many?
Most cookies are written by scripts after the page has loaded, and the scan doesn’t run scripts. It reports the script that would write them, under “Third-party services on load”, and only the cookies set directly by the server.
Is a “Reject all” button required?
Under the GDPR, refusing has to be as easy as accepting. Data protection authorities in France, the UK and several other countries read this as a refusal option on the first screen of the banner, as visible as the accept button.