Cookie checker

What this cookie scanner checks

Our cookie scanner visits the page you enter in a real browser, the way a brand-new visitor would. It doesn’t accept, reject or close the cookie banner. It lets the page load, then lists everything that showed up:

• Cookies, with their domain, category, expiry and security settings.
• Browser storage, the localStorage and sessionStorage keys a page writes. They aren’t cookies, but they can do a similar job.
• Trackers, the analytics, advertising and other third-party tools the page loaded. Analytics tools that work without cookies, like Fathom, are listed as scripts instead.

We also look for a consent banner and tell you which one it is when we recognise it.

Some tools are installed but wait for the visitor to accept first. We can spot some of them without accepting, from the site’s Google Tag Manager setup or from scripts the banner is holding back, and list them as waiting for consent with the cookies they usually set. Sites can hold tools back in ways we can’t see from the outside, so an empty list doesn’t mean nothing is waiting.

What “before consent” means

A consent banner asks visitors to choose before certain cookies are set. “Before consent” covers everything that appears while that question is still unanswered. If a cookie shows up in your results, the page set it before the visitor had a chance to say yes or no.

That isn’t automatically a problem. Some cookies are strictly necessary, like the one that keeps a shopping cart working or protects a login form. But if analytics or advertising cookies appear here, it’s worth checking whether they’re supposed to wait.

A scan is a snapshot of one page, from one location, at one moment. Sites can behave differently by country, by page or after a visitor clicks around, so treat your results as a helpful starting point rather than a full audit.

How to read your results

Categories

We group each finding by what it’s typically used for:

• Functional: keeps features working, like remembering a consent choice, a language or what’s in a cart.
• Personalization: tailors what you see, like layout preferences or recently viewed items.
• Analytics: measures how people use the site.
• Marketing: advertising, retargeting and conversion measurement.
• Security: protects the site and its visitors, like bot protection or guarding a login form.
• Unknown: we couldn’t match it to a known tool. Your developer or the vendor’s documentation will know more.

Categories come from known vendors and cookie names in the Open Cookie Database, plus a few corrections of our own, so they’re a well-informed guess. You know what your site actually uses each cookie for, and that purpose is what matters for consent.

First party vs third party

A first-party cookie belongs to the site you’re visiting. A third-party cookie belongs to another domain, often an ad network. First party doesn’t mean the site wrote it, though. Google Analytics sets its cookies on your own domain, so _ga shows up as first party even though Google’s script put it there.

Expiry

Session cookies disappear when the browser closes. Persistent cookies stick around until their expiry date, and some last for years. A long expiry lets a tool recognise the same browser on later visits. That’s handy for advertising, and usually more than you need to count visits.

When do cookies need consent?

Here’s the short version, in plain words. It’s a general overview rather than legal advice, and the details depend on where your visitors are and what each cookie does. If you’re unsure, check with a privacy professional.

UK: PECR

The Privacy and Electronic Communications Regulations cover storing or reading information on a visitor’s device, including cookies and similar technologies. You generally need consent unless an exception applies, such as storage that’s strictly necessary for a service the visitor asked for. There’s also a conditional exception for statistics used to improve your own website, which comes with clear information and a simple way to object. The ICO’s guidance on exceptions explains the conditions, and our PECR guide covers analytics.

EU: ePrivacy and GDPR

Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a visitor’s device, unless it’s strictly necessary to provide a service the visitor requested or to carry a communication. The GDPR sets what valid consent looks like: freely given, specific, informed and unambiguous, and as easy to withdraw as to give. The EDPB’s guidelines explain how the rules reach beyond cookies, and each country’s regulator publishes its own guidance. Our ePrivacy guide has more.

US: state privacy laws

There’s no single federal law in the US that requires a cookie banner. State privacy laws, like California’s CCPA (as amended by the CPRA), mostly focus on notice and the right to opt out of the “sale” or “sharing” of personal information, which can include some advertising cookies. Covered businesses also need to respect opt-out preference signals such as Global Privacy Control. The California Privacy Protection Agency’s FAQ is a good place to start, and other states have their own laws.

Do analytics cookies need a cookie banner?

Often, yes. Google Analytics 4 sets two first-party cookies by default: _ga, used to distinguish users, and _ga_<container-id>, used to keep session state. Both last two years, according to Google’s own documentation. In the EU, cookies like these generally need consent. In the UK, they need consent unless your use meets the conditions of an exception.

Cookieless analytics takes a different approach. Fathom doesn’t set cookies to measure your website, so it adds nothing to the cookie list you see here. That may make your banner simpler, though whether you need one depends on everything else your site loads and the rules that apply to you. How Fathom Analytics works explains how we count visitors without cookies, and our compliance guides go into more detail.

How to remove cookies you don’t need

1. Start with the list. Download the CSV and go through it with whoever looks after your site. For each row, ask: do we still use this?
2. Remove tools you’ve stopped using. Old ad pixels, a chat widget from two redesigns ago, that A/B test from 2019. They tend to linger.
3. Check your tag manager and plugins. Plenty of cookies arrive through a Google Tag Manager container or a WordPress plugin rather than your own code.
4. Load the rest after consent. If you keep a tool that needs consent, set up your consent tool to hold it back until the visitor agrees.
5. Choose lighter tools. For analytics, a cookieless tool like Fathom gives you the numbers without adding to the list.
6. Scan again. Run the checker after each change to make sure things look the way you expect.

Frequently asked questions

Is this cookie checker free?

Yes. It’s free, and you don’t need to sign up or give us your email address. We do limit how often scans can run, so the scanner stays quick for everyone.

Does this page set any cookies?

No. The cookie checker doesn’t set cookies or store anything in local storage. (It would be a little awkward if it did.) We keep a count of your scans in this tab’s session storage, which clears when you close the tab. We measure visits to this page with Fathom, which doesn’t use cookies either.

Why does my site set cookies before visitors accept?

Usually because a script loads before the consent tool has a chance to step in. Tag manager settings, plugins and hard-coded snippets are the usual suspects. Some cookies are strictly necessary and meant to be set straight away, so check what each one does before you remove it.

Can the checker tell me if my website is compliant?

No, and we’d be wary of any tool that says it can. We report what we found before consent. Whether that’s fine depends on what each cookie is for, where your visitors are, which exceptions apply and what your privacy notice says. A privacy professional can help with that part.

How accurate are the results?

They’re our best effort. Each scan is an automated snapshot of one page, loaded once, from the location shown on the report. Sites can behave differently by region, page, login or over time, and some cookies are hard to identify, so we can miss or mislabel things. If something looks off, run a fresh scan or check the page in your own browser.

Why are my results different from what I see in my browser?

We scan from one location as a first-time visitor, with no extensions, saved choices or login. Your browser may have answered the banner already, block some scripts, or get a different version of the site for your country. Each result shows where the scan ran from, so you can compare like with like.

Can I share my results?

Yes. Copy link gives you a link that runs a fresh scan of the same site, so whoever opens it sees the current result. Share on X posts your grade with a link to the checker, but not the site you scanned. You can also save the report as a PDF, which is handy for sending around or attaching to a ticket.