Free No signup · Stays on your machine

Cookie Consent Auditor

Paste a URL. We scan it for analytics and advertising trackers, flag the ones that fire before consent, and tell you which expose you to Schrems II / GDPR risk.

Paste a URL. The audit fetches the page HTML on the client side via a CORS-friendly fetcher and reports every analytics / advertising tracker that fires before consent. All processing in your browser. Nothing uploaded.

Tracker	Vendor	Risk	Where

Risk legend: high — fires before consent + transfers to non-EU · medium — fires before consent · low — first-party or consent-gated.

What it does

The Cookie Consent Auditor checks any public URL for embedded trackers — Google Analytics, GTM, Meta Pixel, TikTok, LinkedIn, Hotjar, FullStory, Segment, and 15+ others. It flags each by risk level:

High risk: fires before consent and transfers data outside the EU (Schrems II concern)
Medium risk: fires before consent but stays first-party or within EU
Low risk: already consent-gated or first-party (Plausible, Matomo, Fathom, Umami)

How to use it

Paste a URL. The audit fetches the page HTML on the client side and scans for known tracker patterns. All processing in your browser. The URL is fetched via a public CORS-friendly proxy — nothing is stored or logged.

Limitations

This tool checks static trackers — scripts in the initial HTML response. Trackers loaded dynamically (Tag Manager firing GA after consent, server-side proxies, single-page-app late-binding) will not be detected. For dynamic-loader sites, audit with Chrome DevTools, Network tab, filter by domain.

Why this matters for migration

Before you migrate from GA4 to a privacy-first alternative, you need to know what else fires on your site without consent. Migrating analytics does not fix Meta Pixel firing pre-consent. The auditor surfaces the broader trackers that need attention as part of the same compliance pass.