Cookie consent checker
Scan any website's first-visit experience: which consent platform it uses, and which analytics or advertising cookies are set before the user has clicked anything.
The technical check every cookie audit starts with
Consent rules are enforced on the technical reality of your site, not on your privacy policy: if _ga or a Facebook pixel cookie lands on the user's device before they click "Accept", the most polished banner in the world won't make it compliant. Regulators and bounty hunters alike start from exactly this check.
This tool fetches your homepage with a clean profile — no consent, no JavaScript execution — detects the embedded consent platform from over a dozen known CMPs, lists every cookie the server attempts to set, and classifies the recognizable ones as essential, analytics/advertising or unclassified.
Agencies use it to audit client sites in seconds before a formal review; site owners use it to catch regressions after adding a new marketing tag. SiteFlux can then watch the site continuously — uptime, performance, SEO — as part of the same subscription.
Frequently asked questions
What does this cookie checker test?
Two things. First, whether a consent management platform (CMP) like Iubenda, Cookiebot, OneTrust, Didomi or Complianz is embedded in the page. Second, which cookies the server tries to set on a first visit with no consent given — the exact situation GDPR consent rules are about.
Which cookies can be set before consent?
Under GDPR and the ePrivacy rules, only strictly necessary cookies — sessions, security tokens, load balancer routing and the consent record itself. Analytics, advertising and profiling cookies require prior consent. The tool classifies known cookie names into these categories.
Why are some cookies 'unclassified'?
Cookie names are arbitrary, and a custom name like 'usr_8f3a' can't be classified from the outside. Unclassified doesn't mean compliant or non-compliant — it means you need to check what your application sets it for.
Is this a GDPR compliance certificate?
No. This is an automated, indicative scan of the first-visit experience: it doesn't execute JavaScript-based banners, doesn't simulate a user clicking accept, and doesn't assess your legal texts or consent records. Full compliance requires a proper audit — but this scan finds the most common technical mistakes in seconds.
Scanned your site once? Add SiteFlux monitoring to keep an eye on uptime, performance and SEO regressions 24/7.
Create a free monitor →