Free tool
Cookie Banner Check
See which cookies and trackers a site loads before you agree to anything. A banner that appears after the tracking has already started is decoration, not consent.
What a compliant banner is supposed to do
Under GDPR and the ePrivacy directive, non-essential cookies and tracking scripts are supposed to wait. The page loads, the banner appears, and nothing that profiles the visitor runs until they have actively agreed. Consent has to be freely given, specific and informed, and refusing is meant to be as easy as accepting.
That is the design. What this tool measures is whether a given site implements it, and the gap is frequently large. A great many banners are cosmetic: the tracking scripts load with the page, the banner records a preference, and the preference changes nothing that has already happened.
How to read the result
The scan makes one request, exactly as a first-time visitor would, and clicks nothing. Every tracker in the pre-consent list therefore loaded without permission. Every cookie listed was set by the server before the visitor had any opportunity to decide.
Consent management platforms themselves appear separately, because they occupy an odd position: they are third-party scripts that necessarily load first in order to ask the question. That is legitimate. It is everything alongside them that is worth examining.
Why this keeps happening
Usually it is a sequencing failure rather than a decision. A team installs a consent platform, configures the banner, and never moves the existing tags behind the consent gate, so the banner displays correctly while the tags fire as they always did. From the outside it looks indistinguishable from deliberate evasion.
The regulatory position has tightened considerably. We covered the direction of travel in GDPR cookie banner enforcement and the parallel developments in the United States in the CCPA adtech ruling. The broader shift to first-party tracking, which sidesteps this category of check entirely, is covered in first-party tracking without consent.
If you own the site
The fix is almost always ordering rather than tooling. Move every advertising and analytics tag behind the consent gate in your tag manager, then re-run this scan from a clean session. If the pre-consent list is empty afterwards, the banner is doing its job.
To see the full picture of what loads once consent is granted, run the same address through the tracker scanner.
Frequently asked questions
How do I check if a cookie banner is compliant?
Enter the address above. The scanner requests the page as a first-time visitor who has agreed to nothing, then reports which trackers loaded and which cookies were set anyway. Non-essential tracking that appears before any interaction is the clearest sign a banner is decorative.
Are all cookies before consent a violation?
No. Cookies that are strictly necessary for the service, such as session and security cookies, are permitted without consent under GDPR. Advertising and analytics cookies generally are not. This tool reports what happened; whether a specific cookie qualifies as necessary is a legal judgement, not a technical one.
Why does the scan show a banner but no consent vendor?
Many sites implement their own banner rather than using a commercial consent platform. The scan detects the banner from the page text and markup, but there is no third-party vendor domain to name.
Does rejecting cookies actually stop tracking?
Sometimes. A correctly implemented banner gates the scripts behind your choice. A decorative one loads everything regardless and records your preference without acting on it. If trackers appear in this scan before any interaction, the banner is not gating them.