Cookie Scanning Tools for Websites: What They Cat…

Cookie Scanning Tools for Websites: What They Catch and Miss

Cookie scanning tools check your site for cookies, tracking scripts, and consent setup issues. Most work as static scanners: they read the page and list cookies found. Static scans give a useful inventory but miss pre-consent firing, dynamically loaded trackers, and consent bypass scenarios. For real GDPR compliance verification, pair cookie scanning with runtime auditing.

Cookie scanning tools are commonly used for initial cookie inventories and cookie policy generation. This guide explains how they work, what their limits are, and when to use a runtime compliance audit instead or alongside. Scope: EU/EEA GDPR and ePrivacy Directive. UK GDPR applies equivalent principles.

This article is for educational purposes and does not constitute legal advice. For compliance decisions, consult a qualified legal or privacy professional.

Cookie scanning tool: A tool that visits your website and records the cookies set, typically categorizing them (strictly necessary, analytics, marketing) and producing a report or cookie policy. Most work as static or snapshot-based scanners.
Static scan: Analysis based on a single page load: what cookies are set, what scripts appear in source. Does not simulate user interactions, test consent rejection, or observe dynamically loaded content.
Runtime audit: Testing that runs your site in a real browser and observes actual behavior: what fires before consent, what runs after rejection, what third-party requests are made. Detects issues static scans cannot.

How cookie scanners work

A typical cookie scanning tool:

Visits your page (usually without accepting or rejecting cookies).
Records cookies set in the browser during that visit.
Categorizes cookies (e.g. necessary, functional, analytics, marketing) using a cookie database.
Produces a report or cookie policy text listing those cookies.

This gives you an inventory of cookies visible on that single visit. It is useful for understanding what cookies your site sets and for generating a cookie policy.

Common blind spots in static scans

Static cookie scanners have known limitations that affect GDPR compliance assessment:

Pre-consent firing is not tested. A static scan loads the page without simulating a consent state. It cannot tell you whether cookies fire before the user accepts — only a runtime audit with consent rejection can.
Dynamically loaded trackers are missed. Scripts injected via JavaScript after page load, via Google Tag Manager, or via lazy-loading are often not captured.
CMP bypass is not detected. If your CMP is misconfigured and non-essential cookies fire even when rejected, a static scanner will not notice — it never clicks "Reject."
Third-party request scope is limited. Many scanners record cookie names but do not map the full set of third-party network requests (pixels, beacons, API calls) that may also transmit personal data.
Single-page coverage. Most free scanners scan one URL. Complex sites with many routes, login states, or app views require broader scanning.

Check what fires before consent. A cookie list alone does not confirm compliance.

When to pair scanning with runtime compliance audits

Use a cookie scanning tool when you need:

A quick cookie inventory for policy generation.
A list of what cookies are present on a given page.
A starting point before a more thorough compliance review.

Use a runtime compliance audit when you need to verify:

That no non-essential cookie or tracker fires before consent.
That rejecting cookies actually stops tracking.
What third-party domains receive data on a visit.
Whether your compliance setup is working after a release or CMP change.

For most GDPR-regulated websites, a cookie scan is a starting point — not a substitute for runtime verification. See How to audit your website for GDPR compliance for a step-by-step approach.

Methodology and sources

Analysis based on EDPB Cookie Banner Taskforce findings and ePrivacy Directive enforcement patterns.
Last updated: 2026-03-26.

Cookie Scanning Tools for Websites: What They Catch and Miss