Free tool · No signup

GDPR cookie consent checker

We visit your site three times — ignoring, rejecting and accepting the cookie banner — and show what loads each time, so you can see whether the banner actually works.

No signup · Results in ~40 seconds · Nothing stored except the shareable report

What we check and why

Three visits, side by side

A cookie banner can look perfect and still do nothing: trackers fire as soon as the page loads, or keep running after the visitor clicks reject. The only way to know is to test behaviour. We open your homepage in a fresh Chrome profile three times and record every cookie, browser storage entry, network request and known tracker.

Fresh visit: no interaction at all — what loads before any consent?
Reject visit: we find and click the reject button, in many languages and for common consent tools, then record what still loads.
Accept visit: we click accept, to show what your consent actually enables.

What we look for

Trackers before consent: Google Analytics 4, Google Ads and DoubleClick, Meta Pixel, LinkedIn, TikTok, Microsoft Clarity, Hotjar, FullStory and others.
Third-party fonts, YouTube and Google Maps embeds loaded before consent.
Trackers or cookies still present after rejecting.
Banner design: a reject option on the first layer, accept and reject with similar prominence, no pre-ticked categories and granular settings.
Google Consent Mode v2 signals, the consent management platform in use and links to privacy and cookie policies.

Why behaviour matters more than the banner

Under Article 5(3) of the ePrivacy Directive and the GDPR's standard for consent, storing or reading non-essential identifiers on a visitor's device generally requires prior, freely given, informed and unambiguous consent. The Court of Justice of the EU ruled in Planet49 (2019) that pre-ticked boxes are not valid consent. Several data protection authorities, including France's CNIL, have fined companies whose banners made refusing harder than accepting, and the EDPB's 2023 cookie banner taskforce report describes the common problems.

The report phrases findings as potential GDPR or ePrivacy technical risks. It is not a compliance certificate and not legal advice: lawfulness also depends on your purposes, legal bases, contracts and national rules.

Fixing common problems

Most problems are configuration issues in the consent tool or tag manager: tags firing on page load instead of waiting for consent, a reject button hidden behind a settings link, or scripts hard-coded in the theme so the consent tool cannot control them. Move all non-essential tags into the tag manager or consent tool, block them until consent, and run the checker again to confirm.

Frequently asked questions

Is a reject button on the first layer mandatory?

The GDPR does not name buttons, but refusing must be as easy as accepting. Several authorities, including the CNIL, have treated a missing first-layer reject option as a problem.

Is Google Analytics allowed before consent?

Generally not when it sets cookies or similar identifiers in the EU. Consent Mode can send cookieless pings before consent; whether that is acceptable is debated, so ask your adviser.

Why do you flag Google Fonts and YouTube?

Loading them from Google's servers sends the visitor's IP address to Google before consent. Self-hosting fonts and click-to-load embeds avoid that.

What if your scan did not find my banner?

Some banners load late or use unusual markup. The fresh-visit results remain valid; the reject and accept columns will show as not tested.

Does this make my site GDPR compliant?

No tool can. The checker detects technical behaviour that commonly indicates risk; fixing it is an important step, but compliance needs a broader review.