Cookie Scanner — see which cookies and trackers load before consent
A fresh real browser visits your site and never touches the cookie banner — then lists every cookie it set, every tracker it contacted and the consent signals it sent, before anyone said yes.
How it works
-
Enter your website
Any public page — the homepage is where most first visits start. Nothing to install, no signup, and the result is never published.
-
A first visit, banner untouched
A fresh real browser with no cookies loads the page and scrolls it like a visitor would, but never clicks Accept or Reject — so it records what happens before consent.
-
See every cookie and tracker
Cookies with their owner and lifetime, trackers contacted, the consent platform and Google Consent Mode defaults — with a CSV export for your privacy review.
What happens before anyone clicks "Accept"
Most cookie checkers either list every cookie a site sets at some point, or click "Accept" so the scan can get on with it. Both answer the wrong question. The moment that matters is the first one: a new visitor arrives, the consent banner appears — and before they have chosen anything, the page has already done whatever it does. That is the state regulators look at first, and the one this scanner records.
A fresh real browser with no cookies or stored data opens your page, waits for it to load, and scrolls it the way a visitor would. It never clicks the banner. Then it reports what is already there: the cookies that were set, the tracking services the page contacted, and the consent signals it sent. The browser is Monity's own monitoring engine, with its ad blocker and banner auto-clicker switched off for this scan so that nothing is hidden and nothing is consented to on your behalf.
What the scan reports
- Cookies — each cookie present after the first visit: its name and domain, first or third party, the vendor behind it when it is a known one, its likely purpose and how long it lasts.
- Trackers contacted — analytics, advertising, session-replay and other tracking services the page sent requests to, recognised from Monity's catalog of well-known vendors. A tracker can collect data without setting a single cookie: the request itself carries the visitor's IP address and the page they are on.
- Consent platform — whether a recognisable consent management platform runs on the page.
- Google Consent Mode — the default consent state the page declares to Google's tags before the visitor chooses.
The cookie and tracker tables download as CSV for your records or your privacy team.
Why "before consent" matters
In the EU and the UK, the ePrivacy rules require consent before a site stores or reads information on a visitor's device, unless it is strictly necessary for a service the visitor asked for — and that consent has to meet the GDPR's standard: freely given, specific, informed and unambiguous, which means given before the cookie is set. Analytics and advertising cookies generally fall on the consent side of that line; a shopping basket, a login session or the record of the visitor's consent choice generally do not.
This is actively enforced. France's CNIL issued dozens of cookie sanctions in 2024 and 2025, among them a €150 million fine for Shein in 2025 that cited advertising cookies placed before visitors had interacted with the banner. In the United States the model is different — opt-out rather than opt-in under state privacy laws such as California's — but regulators there have fined companies for ignoring the Global Privacy Control opt-out signal, and lawsuits over tracking pixels are common. This scan does not test Global Privacy Control; it records the first visit.
None of this makes the scanner a legal opinion. It reports what one browser saw. Whether a given cookie needs consent depends on its purpose, your legal basis and the law that applies to your visitors.
Reading your results
Cookies set before consent
Look first at third-party cookies and at well-known analytics and advertising names such as
_ga, _gcl_au or _fbp. If they appear in this scan, the tags that set
them are running before the visitor chooses. First-party cookies with names you do not recognise are
worth tracing too — an "unknown" purpose is not necessarily a tracking cookie, but it should be one you
can explain.
Trackers contacted before consent
A request to an advertising or analytics server before consent usually means a tag fires on page load instead of waiting for the consent state. Session-replay tools deserve particular attention because they can record what visitors type.
Google Consent Mode
"Denied by default" means the page tells Google's tags to hold back until the visitor agrees. In Consent Mode's "advanced" setup Google's tags still load and send cookieless pings before consent, so you may see requests to Google even with denied defaults — that is how advanced mode is designed, and whether it fits your policy is your team's call. "Basic" mode blocks the tags until consent.
Fixing what the scan finds
- Load your consent platform before any tag, and gate every non-essential tag on its consent state in your tag manager.
- Check for scripts hard-coded in the theme or added by plugins — they bypass the tag manager's consent rules.
- Set Google Consent Mode defaults to denied for the regions that need it, and confirm your tags honour them.
- Scan again after the fix, from a fresh browser, to confirm the first visit is clean.
Keep it clean as tags change
A clean scan today does not stay clean on its own. Campaigns add pixels, a plugin update brings its own analytics, and a tag manager can publish a new tag without a deploy. Monity's cookie & tracker watch re-runs this scan on a schedule and alerts you in Slack, Teams or email when a new tracker or tracking cookie appears, or your consent platform changes or disappears — and, if you switch the rule on, whenever tracking starts before consent — with the history to show when it changed.
To see every script behind those trackers — with content hashes and where each sends data — run the website script scanner. For the rest of the page, the accessibility checker and the SEO audit cover the other questions a first visit raises.
FAQ
Common questions
What does the cookie scanner check?
What a first visit does before the visitor makes a choice: every cookie present after the page loads (name, domain, first or third party, the vendor behind it when known, and how long it lasts), every tracking service the page contacted — analytics, advertising, session replay — recognised from Monity's catalog of well-known vendors, the consent platform when it is a recognisable one, and the Google Consent Mode defaults the page sends.
Is it a problem if cookies are set before consent?
It depends on the cookie and on the rules that apply to you. Under the EU and UK ePrivacy rules, storing or reading information on a visitor's device needs prior consent unless it is strictly necessary for a service they asked for — so a basket or login cookie is fine, while analytics and advertising cookies generally have to wait. Regulators enforce this: in 2025 France's CNIL fined Shein €150 million, citing advertising cookies placed before visitors interacted with the banner. US state privacy laws work on an opt-out model instead. This tool reports what happened; whether it is allowed is a question for your privacy team.
Why doesn't the scanner click "Accept"?
Because the moment before a choice is the one that matters most and the one many scanners never look at: once "Accept" is clicked, every tracker is allowed and the report can no longer tell which ones loaded too early. This scan keeps the banner untouched for the whole visit. It does not yet test what happens after "Reject" or with Global Privacy Control switched on.
What is Google Consent Mode, and what does "denied by default" mean?
Consent Mode is how a site tells Google's tags what the visitor has agreed to, with four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google has required the last two (Consent Mode v2) for EEA traffic since March 2024. "Denied by default" means the page starts with every signal denied until the visitor chooses. In the "advanced" setup Google's tags still load before consent and send cookieless pings, so you may see requests to Google even with denied defaults — that is how advanced mode works, and your team decides whether it fits your policy.
Are my results private?
Yes. Results are not published, not indexed and not tied to an account; they are kept for about an hour so you can come back to them, then expire. "Copy shareable link" shares the address, not the result — whoever opens it runs a fresh scan of their own.
Can it see cookies set after consent, or on other pages?
Not in this scan. It records one first visit to the page you enter, from one location, with nothing clicked. Pages behind a login, cookies set after a visitor accepts, and banners shown only in other countries are outside what a single visit can see — scan your most important entry pages one by one.
Can Monity alert me when a new tracker shows up?
Yes. Marketing tags arrive with every campaign, and a tag manager can publish a new one without a deploy. Monity's cookie & tracker watch re-runs this scan on a schedule and alerts you in Slack, Teams or email when a new tracker or tracking cookie appears, or your consent platform changes or disappears — and, if you switch the rule on, whenever tracking starts before consent. It is part of Monity's paid plans; you can create an account free and start with the free plan's 3 monitors.
New tags arrive with every campaign.
Monity spots them first.
Monity re-scans your site on a schedule and alerts you when a new tracker or tracking cookie appears, or your consent platform changes or disappears.
- Free 7-day trial
- No credit card
- 3 monitors free, forever