Pricing

Rating

Developer

Actor stats

Categories

Share

GDPR Cookie Compliance Scanner

Scan any website for GDPR cookie compliance violations in seconds. Privacy audits and consent banner checks are time-consuming when done manually — run bulk scans across client portfolios and get a clear Pass/Warning/Fail grade for each site. Built on a real browser engine to catch JavaScript-set cookies that static scanners miss.

Features

• Pre-consent cookie detection — identifies analytics, marketing, and tracking cookies set before user consent
• Cookie categorization — classifies every cookie as necessary, analytics, marketing, functional, or unknown
• Consent banner detection — recognizes major CMPs including OneTrust, Cookiebot, and Cookie Notice
• Compliance grading — assigns Pass, Warning, or Fail based on GDPR best practices
• Third-party cookie analysis — flags cookies from external domains (Facebook, Google, HubSpot, Hotjar, etc.)
• Post-consent comparison — captures cookies before and after accepting consent to show what changes
• Bulk scanning — process hundreds of URLs in a single run for agency-scale audits

Input

Input Example

{
"urls":[
{"url":"https://crawlee.dev"},
{"url":"https://example.com"}
],
"waitForBanner":true,
"timeout":30000
}

Output

Each scanned URL produces a detailed compliance report with cookie inventories, categorization, consent banner status, and a compliance grade.

Key output fields:

• url — the scanned page URL
• complianceGrade — Pass, Warning, or Fail
• issues — list of specific compliance problems found
• preConsentCookies — cookies present before any user interaction
• postConsentCookies — cookies added after accepting the consent banner
• cookiesSetWithoutConsent — non-necessary cookies loaded before consent (the main GDPR risk)
• consentBannerDetected — whether a cookie consent banner was found
• consentManagementPlatform — detected CMP (OneTrust, Cookiebot, etc.)
• totalCookies — total cookie count across the session
• trackingCookies — number of identified tracking cookies
• thirdPartyCookies — cookies from external domains

Output Example

{
"url":"https://example.com",
"timestamp":"2025-01-15T10:30:00.000Z",
"complianceGrade":"Fail",
"issues":[
"3 non-necessary cookies set before consent",
"2 tracking cookies set before consent"
],
"consentBannerDetected":true,
"consentManagementPlatform":"OneTrust",
"totalCookies":12,
"trackingCookies":5,
"preConsentCookies":[
{
"cookie":{"name":"_ga","domain":".example.com","path":"/","expires":1737000000},
"category":"analytics",
"isTracker":true,
"trackerType":"Google Analytics"
}
],
"thirdPartyCookies":[
{
"cookie":{"name":"_fbp","domain":".facebook.com","path":"/","expires":1737000000},
"category":"marketing",
"isTracker":true,
"trackerType":"Facebook Pixel"
}
]
}

Pricing

Free tier available — pay only for Apify platform usage beyond free limits.

Use Cases

• Privacy compliance audits — scan client websites before GDPR audits and generate evidence-ready reports showing cookie violations
• Agency client reporting — run bulk scans across all client domains on a schedule and flag new compliance issues automatically
• Vendor due diligence — verify that third-party SaaS tools and marketing platforms are not setting tracking cookies without consent
• Pre-launch QA — check new websites or redesigns for cookie compliance before going live
• Competitive benchmarking — compare cookie practices across competitors to identify industry-standard consent implementations

Related Actors

Notes

• The scanner uses a real Chromium browser via Playwright, so it captures JavaScript-set cookies that HTTP-only scanners miss.
• Consent banner detection relies on common CMP selectors (OneTrust, Cookiebot, generic patterns). Custom or uncommon banners may not be detected.
• Compliance grading is advisory — it highlights common GDPR issues but does not constitute legal advice.