Cookie consent scanner
A cookie consent scanner loads a site the way a first-time visitor would: no clicks, no “accept all.” Complience.app lists cookies, known marketing hosts, and leftover cookies the vendor list does not know that fired before consent.
Scan pre-consent tracking
Paste a public URL. No clicks, no Accept. Get a GDPR cookie audit of what the browser did.
How the scan works
Playwright opens the homepage in a clean browser session and watches what happens. We record the cookies set by the page, a few relevant security flags (Secure, HttpOnly, SameSite), and requests going to third-party hosts.
Known analytics and advertising hosts are flagged straight away. For everything else, we classify the remaining cookies and hosts by type. We only treat something as a critical marketing finding when the classification is confident.
The important part is timing: if a marketing cookie or host appears before any consent click, the scan marks it as critical.
What happens when the vendor isn't on our known list?
A hardcoded vendor list will always have gaps. New CDNs appear, CMP vendors change, and first-party analytics can use names that don't look like analytics at all.
Complience.app keeps a known list in code, but it doesn't assume that list is complete. Anything it doesn't recognise is classified separately. If we're not confident about the classification, it stays unknown rather than being forced into a category.
What this scan does, and does not
This isn't a CMP, and it doesn't generate a legally sufficient consent banner. It also doesn't prove that a site is GDPR compliant.
What it gives you - an observable evidence you can hand to a developer or client. For example: this marketing tracker ran at 0ms, before consent.
The UK ICO’s cookies guidance says non-essential cookies should wait for a clear positive action. CNIL fined Google €325 million in September 2025 for cookie and advertising-consent failures (CNIL, 3 September 2025). A visible banner is not that test. The first-load log is. See why a banner can still leak.
Use the scan alongside the banner you already have
You don't need to replace your consent manager. Keep it, and use the scan to check whether it's actually doing its job before consent.
You can see examples of how the scan works alongside:
Why WAVE doesn't cover this
WAVE and Lighthouse are useful for what they are designed to do: checking accessibility and the page's technical structure.
They aren't running a clean browser session to see which marketing cookies and third-party requests appear before consent. That's the gap this scan is designed to cover.
WordPress sites are a common example, because plugins can introduce pixels and third-party requests without it being obvious from the page itself. If you're auditing a WordPress site, you can also scan the public theme with the WordPress accessibility checker.
