GDPR cookie scanner
Surface third-party domains and pre-consent cookies — GDPR-critical.
How this tool works
A GDPR-compliant website must NOT load trackers before consent — no Google Analytics, no Meta Pixel, no external font, no Hotjar, no Maps iframe. This scanner loads your page in a real headless Chromium (without clicking consent) and captures every third-party domain the browser actually contacts — including JavaScript-injected trackers, dynamically loaded beacons (e.g. Google Tag Manager, gtag calls, Meta Pixel `/tr`) and document.cookie cookies. External domains are categorised against a tracker database (analytics, ads, social, fonts, cdn, maps, video, chat). Cookies are listed with their flags (Secure, HttpOnly, SameSite, Third-Party). Active trackers are additionally detected via the JavaScript window scope (`gtag`, `fbq`, `_paq`, `_hjSettings` etc.). Verdict: clean / review / critical.
Typical use cases
- First GDPR assessment of a website within seconds
- Before an audit or lawyer cease-and-desist, document your stance
- After cookie banner implementation, verify no trackers actually load before consent
- In an agency, regularly screen client sites — marketing often adds pixel tags carelessly
Frequently asked questions
Is the scan sufficient as GDPR evidence?
It is an indicator, not an audit. A complete GDPR audit requires cookie banner testing, privacy policy review, processor contracts etc. This scan catches the obvious problems (pre-consent trackers).
What do the categories mean?
analytics (problematic without consent: GA, Matomo, Hotjar, …), ads (critical: Meta Pixel, Google Ads, …), social (critical: X embed, LinkedIn Insight, …), fonts (Google Fonts: GDPR risk after Munich district court 2022), maps/video/chat (often with tracker cookies), cdn (usually uncritical), other (verify manually).
Does the scan load the page like a browser?
Yes — we load the page in a real headless Chromium (same engine as Chrome) and execute JavaScript. Trackers loaded dynamically (Google Tag Manager, gtag, fbq, Hotjar loader) are captured. document.cookie cookies that are not set via HTTP headers are also visible. Compared to plain HTML parsing we typically find 3-10× more third-party domains.
Are Google Fonts really a GDPR problem?
After the Munich district court ruling (2022) yes, if loaded from Google's CDN without consent. Solution: self-host the fonts (bundle them locally).
What about cookie banner bypass via specific devices?
Some banners load trackers conditionally (e.g. only mobile, only certain browsers). We scan with desktop Chrome user agent. For mobile detection, use XICTRAQ monitoring in your account.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.