GDPR Cookie Banner Audit

See whether the first HTML of a site offers a real Reject control

100% free. This tool needs our server to do the work, so what you submit is sent there, processed and then discarded - it is never stored.

Static HTML only. Banners injected after load will be missed, which is itself a finding if trackers already ran.

Jump to the next useful tool without leaving your flow.

See more

About this tool

EU and UK cookie rules expect a genuine choice, not only Accept. This audit fetches the first HTML of a URL and looks for a Reject or essential-only style control, plus other banner clues. It does not execute the consent platform's JavaScript, so a banner injected after load is missed, and that miss is itself useful: if trackers already ran in the first HTML, consent was too late. Static scan, not a lawyer letter. Pair with the cookie scanner for what is actually set.

How to use this tool

  1. Paste the homepage URLThe first HTML response is what shoppers and crawlers get before extra scripts run.
  2. AuditEach check is Pass or Check with a short detail line.
  3. Fix the banner implementationReject must be as easy as Accept, before non-essential tags fire.

What a compliant cookie banner needs

Under EU and UK rules, refusing cookies must be as easy as accepting them: a Reject or essential-only button on the first layer, not hidden behind settings. Non-essential cookies must not be set before consent, and people must be able to change their choice later.

This audit reads the page’s first HTML, so banners injected later by a consent platform may not show up. Pair it with the Cookie Scanner to see which cookies are set before any choice is made.

Key features

  • Looks for Reject / essential-only wording in the first HTML.
  • Honest about SPA banners that never appear in that HTML.
  • Complements the cookie scanner instead of duplicating it.

Common uses

  • Quick pass on a EU-facing marketing site.
  • Catching a CMP that only ships Accept in the first paint.
  • Teaching a team why "banner after gtag" fails the spirit of consent.

Tips for better results

  • If every check fails because the banner is client-only, load the CMP in the first HTML or a noscript equivalent.
  • US sites still get this audit if they have EU visitors. Geography is your policy, not this tool.
  • A Reject button that is hidden with CSS in the first HTML may still "match" as text. Look at the live page.

Mistakes to avoid

  • Calling a Pass a GDPR certificate.
  • Ignoring trackers in the first response because the banner later offers Reject.
  • Scanning a US-only internal tool and treating the result as a product requirement.

Frequently asked questions

No. It is a static HTML pass for a visible Reject or essential-only control and related clues. Supervisory authorities look at design, dark patterns and what actually runs.

Those often inject after JavaScript. This fetch does not run that JS. If trackers are already in the first HTML, consent is too late regardless.

Yes. This page is about the banner copy. Cookie Scanner lists Set-Cookie and common pixels.

Yes. Not legal advice.