Cookie Scanner
Check which cookies and trackers your site sets, and whether your categories cover them.
The scanner loads one page of your site and lists what it can see: cookies set by your server, and third-party trackers it recognises from the script tags in your HTML. Use it to sanity-check that your consent categories actually cover what the site does.
Find it in the dashboard under Customizer → Categories. The scanner is dashboard-only; there is currently no public API endpoint for it.
What it finds
Trackers are matched by script source, so Google Analytics, Meta Pixel, Hotjar, PostHog, Segment, LinkedIn, TikTok and a dozen others are recognised by name. Each result shows the exact script URL that matched, so you can verify it rather than take our word for it.
Cookies come from the page's Set-Cookie response headers. Well-known
names like _ga and _fbp are labelled and categorised; anything unrecognised
is listed as unclassified rather than guessed at.
What it misses
This is a single page load, so it does not see cookies written by JavaScript after the page renders - which is most of them. It is a starting point, not a compliance audit.
Concretely, the scanner will not catch:
- Cookies set by scripts once they run, including most analytics cookies
- Anything on pages other than the one you scanned
- Anything behind a login
- Trackers injected by a tag manager at runtime rather than named in the HTML
Recognising Google Tag Manager in your markup is a strong hint that more is happening than this list shows.
Using the results
Map each result to one of your categories, then confirm the corresponding scripts are blocked until that category is granted. Detection on its own changes nothing: a tracker the scanner found is still running on every page load until you tag it.