Cookie scanner
Check which cookies a URL technically shows, whether tracking cookie candidates appear and which attributes such as Secure, HttpOnly or SameSite are set.
Ideal for fast cookie inventory, consent QA and comparison with data protection notices.
Results
Technical pre-checking of a URL. For multiple URLs, templates and CSV exports, use the GDPR Tracking Audit.
Findings
Detailed hit
What the Cookie scanner evaluated
The exam is deliberately fast and focused. It recognizes technical signals in headers, HTML, JavaScript and resources. Interactions with banners, login, forms and tag triggers should be additionally checked in the browser.
Differentiate cookie find and actual storage
Illustrative example · no measurement result of your website
Set cookie: session_id=example; Secure; HttpOnly; SameSite=LaxA set cookie header shows that the server offers a cookie to the retrieving client. Name and attributes help with the technical classification. They prove neither the specific purpose nor that a browser stores the cookie under all circumstances.
Then check the results in the browser.
- Open the page in a fresh browser profile and check network responses and cookie storage before each banner selection.
- Compare Reject, Agree, and a later revocation. Record name, domain, duration and trigger request.
- Assign each cookie to an actual function. A name like session_id alone proves no technical necessity.
What this check leaves open
Server retrieval does not execute JavaScript. Cookies from later scripts, embedded frames, a login or a checkout may be missing. An empty finding therefore does not mean that the website does not set cookies.
Additionally check browser storage →From individual check to GDPR tracking audit
A tool shows a concrete symptom. The audit checks up to 500 URLs, prioritizes tracking, consent and form risks, and provides export data.
Targeted deepening of GDPR tracking
Recognize tracking and third-party candidates who are already visible in the initial delivered page before a user actively consents.
Third party third partiesFind well-known tracking services, external script hosts, and third-party integrations that are relevant to consent, privacy, and tag governance.
Google Consent ModeCheck if Google tags have technical consent mode signals visible and if denied/granted hints appear in the code.
Storage & FingerprintingRecognize technical storage and access signals such as cookies, LocalStorage, SessionStorage, IndexedDB and fingerprinting candidates.
Consent UXCheck whether known consent management platforms and important banner signals such as rejection, settings and revocation are technically findable.
Web analysisCheck if a URL contains more frugal analytics candidates or marketing/tracking signals requiring consent.
Questions about Cookie scanner
Does the cookie scanner find all cookies?
It recognizes header and HTML/JavaScript signals of the loaded URL. Cookies that arise only after interaction, login or consent should be additionally checked in the browser.
Is a cookie without Secure always inadmissible?
No, but for HTTPS sites, Secure is regularly an important security attribute. Legal evaluation depends on purpose and context.
Is the individual check free of charge?
Yes. The standalone tools check a single URL. For larger crawls, complete tables and CSV export, the premium audit is planned.
Does the tool replace legal advice?
No. The tools provide technical pre-testing. Legal bases, contracts, information obligations and concrete consent flows must be subject to technical review.