Website Cookie Scanner: Find Trackers on Any Website
Scan any website for the cookies its server sets and the analytics, advertising, session-recording and chat trackers in its code, including tags hidden in Google Tag Manager. See whether a consent banner is in place, and download a cookie list for your policy.
- Known service patterns
- Checks supported GTM references
- Cookie list as CSV
Consent and policies
Things to fix
Trackers and services
| Service | Type | Found in | Usually sets these cookies |
|---|
Cookies in the server response
| Cookie | Lasts | Security | Domain |
|---|
Other websites named in this page’s HTML
This checks one page as a first-time visitor who hasn't accepted anything. Cookies created later by JavaScript are listed under "Usually sets". Scan other important pages too.
How to test it
- Scan a large news or shopping site. You should see Google Analytics, Meta Pixel or other ad trackers listed.
- Scan your own website and compare the list with your cookie policy.
- Press Download cookie list and open it in Excel or Google Sheets.
Scans run on our server. Per-visitor scan limits apply.
How this website cookie scanner works
Visits like a new visitor
Our server requests the page and records Set-Cookie headers in the response, including available lifetime and security attributes. It does not run browser JavaScript or confirm every cookie created by the page.
Checks for known service patterns
It searches the page HTML and supported Google Tag Manager references for patterns associated with recognised analytics, advertising, session-recording, chat, embed and payment services. Detection is limited to the patterns this scanner knows.
Checks consent
It looks for recognised consent-tool code, consent-related Google tag settings and privacy or cookie-policy links in the page HTML. A tool or setting added dynamically may not be detected.
Check it yourself. Open your browser's developer tools (F12), choose the Application tab, then Cookies, on the site you scanned, and reload without accepting the banner. The server cookies listed here should appear. If a cookie appears before you make a choice, investigate which script or request created it and whether it should wait for consent under the rules that apply to your site. A cookie's presence alone does not establish a legal violation.
What people use this cookie scanner for
Find your task. The scanner covers each of these.
| Your task | What to use | Action |
|---|---|---|
| Write or update my cookie policy | Scan each important page and export the recognised services and server response cookies. Verify actual browser cookies, purposes and retention periods before updating your policy. | |
| Prepare for India's DPDP Act or GDPR | Review recognised services and verify whether relevant browser requests wait for the visitor's choice. This scan is not a legal-compliance determination. | |
| Find tags an old agency added to Tag Manager | Look for services marked Found in: Google Tag Manager. | |
| My site is slow | The list shows external hosts referenced in the page HTML. It does not measure whether those hosts load or how much they affect performance. | |
| Is my own browser blocking these trackers? | That's the visitor's side. Test your browser instead. | Online Privacy Checker |
How the scan is done
The scanner requests the page with a browser-like User-Agent, follows up to five redirects, and reads up to 1.5 MB of HTML. Set-Cookie headers exposed by the responses are recorded with available lifetime and security attributes.
It checks the page HTML and up to two referenced Google Tag Manager containers for known service patterns. When a service is recognised, commonly associated cookie names may be listed as a reference; they are not proof that those cookies were set on this scan.
No JavaScript runs, so the scan can't click banners or see what happens after consent. It provides a limited server-side snapshot of the response and recognised code; verify browser requests and consent behavior separately.
Sources: MeitY: Data protection framework, Google: Consent Mode, MDN: HTTP cookies.
Types of trackers and what they mean
| Type | Examples | What it means |
|---|---|---|
| Advertising | Meta Pixel, Google Ads, LinkedIn, TikTok, Criteo | May support ad measurement, audience building or targeting. Check the configuration and consent requirements that apply to your site. |
| Analytics | Google Analytics, Yandex, Mixpanel, HubSpot, CleverTap | Measure visits with identifiers. Usually need consent. |
| Session recording | Microsoft Clarity, Hotjar, Smartlook | Record clicks, scrolls and sometimes typing. Need consent and care. |
| Chat and support | Tawk.to, Intercom, Zoho SalesIQ, WhatsApp | Needed for the chat; mention them in your policy. |
| Embeds | YouTube, Google Maps, reCAPTCHA, Vimeo | Contact other companies as soon as the page loads. |
| Fonts and payments | Google Fonts, Razorpay, Stripe | Usually essential or low-risk, but still share visitor IPs. |
| Privacy-friendly | Cloudflare Web Analytics, Plausible, YouTube no-cookie | Some configurations are designed to reduce tracking, but verify actual requests, storage and data handling on your site. |
Cookie mistakes website owners make
Common gaps this scan uncovers.
A banner doesn't block anything by itself. Verify that consent-dependent scripts and requests are actually held back until the visitor's choice.
Old pixels keep running for years. Review your container after every campaign.
A policy that lists the wrong cookies misleads visitors. Base it on a scan.
Login cookies can leak over insecure connections. Add Secure, HttpOnly and SameSite.
Good cookie habits for websites
For site owners
- Rescan after adding plugins, themes or marketing tags.
- Keep a written list of every tracker and why you use it.
- Remove trackers you no longer look at.
- Prefer privacy-friendly analytics where it fits.
- Use YouTube's privacy-enhanced (no-cookie) embeds.
For developers
- Load consent-dependent tags only after the choice is made.
- Set Google Consent Mode defaults before any Google tag.
- Give cookies the shortest lifetime that works.
- Host fonts yourself instead of loading them from Google.
- Mask personal data in session-recording tools.
Frequently asked questions
Short answers about scanning, consent and DPDP.
How does the scanner find cookies and trackers?
Our server requests one public page and records Set-Cookie headers in the response. It then looks for recognisable patterns for known analytics, advertising, session-recording, chat and embed services in the page HTML and in supported Google Tag Manager container references. It does not run browser JavaScript or confirm every browser request.
Why are some cookies listed as “usually sets” instead of found?
Most tracking cookies, like _ga or _fbp, are created by JavaScript in the visitor's browser, which this scan doesn't run. When a service is recognised, the scanner lists cookie names that it may use. Verify which cookies your own site actually sets, when they are created, their purpose and retention period before adding them to your cookie policy.
Can it see everything on my website?
No. It checks one page's server response and recognised code patterns. Pages behind a login, trackers added only after consent, browser-created cookies, and scripts loaded dynamically may not show up. Scan important pages and verify browser requests and your tag manager separately.
Does my website need a cookie banner in India?
India's DPDP framework includes requirements relating to notice and consent for covered personal-data processing. The applicable duties and commencement dates depend on the relevant provisions and rules. Review current official guidance and your site's actual data practices; this scanner is not a legal-compliance determination.
What is Google Consent Mode?
Google Consent Mode communicates consent choices to supported Google tags. A denied default can change how those tags behave, but it does not by itself prove that every request is blocked. This scanner looks for recognisable consent code in the page HTML and may miss configuration added through Tag Manager or other scripts.
Is my scan stored or shared?
Results are kept for one hour so repeat scans are quick, then deleted. If someone scans the same address within that hour, they see the same result. To enforce the limits, we count scans per visitor using a hashed form of the IP address. The scanned website sees one visit from our server, not from you.
Is there a limit?
You can scan 10 websites an hour and 40 a day, so the scanner stays fast for everyone.