GDPR scanner
Scan your website for cookies, tracker scripts, pixels, Google Consent Mode signals, and pre-consent network requests. Get a detailed cookie inventory and scan evidence in under a minute.
Technical checks only, not legal advice.
Need a broader website GDPR compliance check? Use the online GDPR validator to review cookie consent, tracker behavior, policy links, and consent evidence in one flow.
The scanner identifies signals from Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, LinkedIn Insight Tag, TikTok Pixel, and similar third-party scripts that typically require consent review under GDPR and ePrivacy.
A useful scanner doesn't stop at static HTML. GDPRChecker checks whether trackers or measurement endpoints fire network requests before a consent choice is made — the behavior most likely to attract regulatory attention.
Use scan findings to configure a consent banner, categorize cookies by purpose, publish a cookie declaration, and monitor for new trackers over time with scheduled scans.
The scanner loads your homepage as a first-time visitor and inspects every script, pixel, and network request. It identifies known analytics services (GA4, GTM), marketing pixels (Meta, LinkedIn, TikTok), session recording tools (Hotjar, FullStory), and tag management containers. For each detected signal, it records the provider, script source, and whether the request appeared before or after a consent interaction.
Beyond domain matching, the scanner categorizes finds by type: analytics, marketing, functional, and unclassified. It checks for common cookie names set by third-party services and flags patterns like _ga, _fbp, _hjSession, and li_sugr. Each cookie is mapped to a known provider and suggested category so you can build or validate a cookie declaration quickly.
The pre-consent check captures the timing of every third-party request relative to consent banner interaction. If Google Analytics collect hits, Meta Pixel PageView events, or GTM container loads fire before the visitor accepts or rejects cookies, the scanner flags them. It also checks whether Google Consent Mode v2 default commands (gtag consent.default) are set before tags load — a key signal for Google-specific compliance.
Every scan produces timestamped evidence: detected scripts with source URLs, cookie names with domain and expiry metadata, a pre-consent timeline, and a cookie category map. This evidence feeds directly into the cookie inventory where you can review, re-categorize, and publish a cookie declaration. For managed sites, each scan is saved so you can compare results over time and demonstrate change history to auditors.
| Detected signal | What it means | Why it matters for GDPR |
|---|---|---|
| Google Analytics (GA4) before consent | GA4 collect hits fire before consent choice recorded | Personal data (IP, client ID) may be processed without legal basis |
| Meta Pixel PageView | Pixel fires before visitor accepts cookies | Meta receives event data; consent is typically required under ePrivacy |
| Google Tag Manager without consent check | GTM container loads with all tags firing unconditionally | Any tag in the container can fire without consent — hard to audit |
| Google Consent Mode v2 missing | No gtag consent.default commands before tags load | Google treats missing consent signals as implied consent in some regions |
| Hotjar / session recording | Session recording script loads before consent | Records user interactions; requires explicit consent in most EU jurisdictions |
| Unknown third-party domains | Network requests to domains not in known tracker lists | May indicate shadow tracking or unvetted vendor scripts on the page |
Related GDPRChecker tools
GDPRChecker provides automated technical checks, templates, and operational guidance. It does not provide legal advice and does not guarantee compliance with GDPR, UK GDPR, ePrivacy, CCPA, PIPEDA, Law 25, or any other law.