Ott Ristikivi
Website privacy scanners compared (2026)
Website privacy scanners fall into three groups: cookie inventory scanners that list cookies, CMP scanners that classify cookies for a consent banner, and runtime auditors that load the site in a real browser and record what fires before and after consent. Runtime auditors are built to show whether tags actually wait for consent.
This guide covers paid and continuous tools. For free, no-signup checkers, see best free GDPR scanner tools (2026), where we compared seven tools with live scans on 2026-10-01.
Scope: EU/EEA websites and websites with EU visitors, where GDPR and the ePrivacy Directive govern cookies and tracking. Scanners differ in what they can show: some list cookies, others record whether tags wait for consent. Below are 7 website privacy scanners for 2026, compared from their public product documentation, with what each does well and where it needs a complement.
- GDPR scanner
A tool that checks your site for privacy and consent issues (cookies, scripts, policies) against EU rules such as GDPR and ePrivacy.
- Runtime audit
Analysis that runs in a real browser session and observes what actually loads and fires, not just static page source.
A proper compliance audit should identify cookies loading before consent, third-party trackers sending data externally, scripts bypassing consent banners, hidden trackers injected dynamically, and missing or broken privacy disclosures. If your scanner doesn't detect these, you may still be exposed.
Methodology and sources
- Comparison positioning is based on publicly available product pages and docs as of 2026-02-10.
- Regulatory context references include EDPB cookie banner taskforce and CNIL 2024/2025 enforcement summaries.
- Vendor sources: Cookiebot, OneTrust, Termly, Complianz, iubenda, and Osano official pages.
Quick comparison table
| Tool | Primary focus | Runtime visibility depth | Best for | Notes |
|---|---|---|---|---|
| SecureSpells | Runtime compliance auditing | High | Agencies, SaaS, dev teams | Focused on live behavior checks (pre-consent firing, hidden requests). |
| Cookiebot | CMP, cookie governance, consent collection | Medium | Teams prioritizing banner + consent operations | Strong CMP/cookie workflow coverage; runtime depth varies by setup. |
| OneTrust | Enterprise privacy governance and workflows | Medium | Large orgs with formal compliance programs | Broad governance stack; runtime verification often paired with technical testing. |
| Termly | Policy generation + consent management | Medium-Low | SMBs/startups needing fast policy/CMP setup | Easy policy/CMP adoption; deeper runtime checks may require additional tooling. |
| Complianz | WordPress consent and cookie management | Medium-Low | WordPress-first teams | WordPress-native strength; technical depth depends on plugin/configuration scope. |
| iubenda | Legal docs + consent tooling | Medium-Low | Teams prioritizing legal docs + consent UI | Strong documentation/policy workflows; runtime behavior testing may need a complement. |
| Osano | Consent + broader privacy/compliance operations | Medium | Organizations needing unified consent/privacy operations | Consent and governance platform; technical runtime verification often added separately. |
Last verified: 2026-02-10 (public product documentation). Capabilities and feature names can change over time.
Best website privacy scanner tools for auditing cookies and trackers 2025–2026
The best website privacy scanner tools for cookies and trackers in 2025–2026 are those that audit runtime behavior: they run your site in a real browser and report what actually fires before consent, not just which cookies exist in a list. An easy website privacy scanner gives you a clear report in minutes; for real compliance detection (pre-consent firing, hidden trackers), choose a tool that performs a live browser audit. The comparison table above summarizes how the listed tools compare.
What a GDPR Scanner Should Actually Detect
A proper compliance audit should identify:
- Cookies loading before consent — Non-essential scripts firing on first load.
- Third-party trackers sending data externally — Pixels, analytics, and ad scripts.
- Scripts bypassing consent banners — CMP misconfiguration or tag manager leaks.
- Hidden trackers injected dynamically — Loaded after page load via JavaScript.
- Missing or broken privacy disclosures — Incomplete or misleading cookie/privacy information.
If your scanner doesn't detect these — you may still be exposed.
For a free website GDPR test, check your site in minutes. For a focused pass on cookies and third-party requests, use the free cookie audit tool. To understand why runtime vs static scanning matters, see the comparison below.
What kind of scanner do you actually need?
Before comparing vendors, match the tool class to your job:
- Need a cookie inventory or policy page? → any static scanner or CMP export is fine.
- Need to prove tags don't fire before consent? → use a runtime cookie audit tool; static tools cannot observe pre-consent execution.
- Comparing Termly vs OneTrust or CMP platforms? → see Termly vs OneTrust (2026): SMB vs Enterprise for a use-case decision table.
- Need evidence for a DPA review or client handoff? → runtime audit output only; static lists do not constitute behavioral evidence.
1. SecureSpells — Best for Real Runtime Compliance Detection
Best for: Agencies, SaaS, developers
SecureSpells is different from traditional scanners.
Instead of only scanning cookies, it performs a runtime compliance audit using a real browser session.
This allows it to detect:
- Scripts firing before consent
- Trackers injected via Google Tag Manager
- Hidden third- and fourth-party requests
- Consent banner failures
Most scanners miss these because they only analyze static content.
SecureSpells also provides:
- Risk scoring based on real GDPR enforcement logic
- Continuous monitoring
- Agency-ready reporting
Run free audit: https://securespells.com
Related:
2. Cookiebot
Best for: Cookie consent management
Cookiebot is one of the most widely used cookie tools, offering industry-leading consent management platform (CMP) functionality.
Strengths:
- Strong cookie scanning and governance
- Reliable consent banner implementation
- Cookie declaration and documentation
- Good integration with various platforms
Best used for: Cookie consent management and banner workflows
Pair with: Runtime auditor for technical verification of pre-consent violations. For how Cookiebot's own pre-consent reporting compares with an independent audit layer, see Feroot vs Cookiebot.
3. OneTrust
Best for: Enterprise compliance
OneTrust is an enterprise-level compliance platform providing comprehensive privacy governance.
Strengths:
- Extensive policy automation
- Robust compliance workflows
- Enterprise-grade vendor risk management
- Comprehensive governance stack
Best used for: Large organizations with formal compliance programs
Pair with: Technical runtime testing for behavior verification
4. Termly
Best for: Small businesses
Termly offers accessible compliance tools designed for SMBs and startups.
Strengths:
- Easy-to-use policy generator
- Fast CMP setup
- Affordable pricing for small businesses
- Simple compliance workflow
Best used for: SMBs/startups needing fast policy/CMP setup. For a detailed SMB vs enterprise CMP comparison, see Termly vs OneTrust (2026).
Pair with: Additional tooling for deeper runtime checks
5. Complianz
Best for: WordPress websites
Complianz is a WordPress plugin offering native integration.
Strengths:
- Deep WordPress integration
- Easy plugin installation
- WordPress-native configuration
- Good cookie consent banners
Best used for: WordPress-first teams
Note: Technical depth depends on plugin/configuration scope
6. iubenda
Best for: Legal document automation
iubenda provides strong legal documentation and policy workflows.
Strengths:
- Excellent privacy policy generation
- Strong legal documentation
- Cookie consent tools
- Good compliance UI
Best used for: Teams prioritizing legal docs + consent UI
Pair with: Runtime behavior testing for technical verification
7. Osano
Best for: Compliance management
Osano offers unified consent and privacy operations.
Strengths:
- Consent management platform
- Broader privacy/compliance operations
- Unified governance platform
- Good workflow management
Best used for: Organizations needing unified consent/privacy operations
Pair with: Technical runtime verification for behavior analysis
Best cookie audit tool vs best scanner: pick by job-to-be-done
"Best cookie scanner" and "best cookie audit tool" attract similar search intent, but they describe different workflows. Use this table to pick the right tool class before comparing vendors:
| Job-to-be-done | Best tool class | Example starting point |
|---|---|---|
| Generate a cookie policy / declaration | Cookie scanner (static) | Any inventory scanner |
| First-pass cookie inventory before launch | Cookie scanner | Static or lightweight runtime |
| Prove pre-consent tags do not fire | Runtime cookie audit tool | SecureSpells cookie audit, runtime-first scanners |
| Prove "Reject all" actually blocks tracking | Runtime cookie audit tool | Runtime scanner with consent-state simulation |
| Ongoing monitoring after releases | Runtime audit with scheduling | SecureSpells scheduled scans |
| Enterprise governance + vendor risk | CMP + governance platform | OneTrust, Osano |
If you need evidence—for regulators, a client, or a DPA review—choose a runtime audit tool, not a static scanner. If you need a cookie list for a policy page, a simpler scanner is fine.
For a focused runtime pass on your domain, use the free cookie audit tool and see what fires before consent. For a shortlist of audit tools by job, see best cookie audit tools (2026).
Why Most GDPR Scanners Miss Real Violations
Most tools rely on cookie lists and static analysis, but GDPR violations often happen at runtime. For example, a script might load after page load via JavaScript—static scanners miss it, but runtime scanners detect it. This is why runtime analysis is increasingly adopted in technical audits.
Learn more: Why runtime compliance matters
How to Choose the Right GDPR Scanner
Choose a tool that:
- Detects runtime behavior — Not just cookie names from static HTML.
- Detects pre-consent violations — Scripts firing before the user accepts.
- Provides actionable fixes — Clear next steps, not just a list of issues.
- Supports continuous monitoring — Websites change; one-off scans are not enough.
Final Verdict
If you want basic cookie visibility, Cookiebot or Termly are sufficient. If you want real compliance detection, use a runtime compliance audit like SecureSpells—because compliance isn't about cookies, it's about behavior.
Related Articles
- Free, no-signup GDPR scanners compared (tested 2026-10-01)
- Feroot vs Cookiebot: which detects pre-consent violations?
- Banner installed ≠ tracking stopped: 90-day runtime data
- Why subscription beats a one-off GDPR audit
- Termly vs OneTrust (2026): SMB vs Enterprise pick
- GDPR Compliance Checklist 2026
- Privacy Policy Best Practices
- Common GDPR mistakes
