Pillar 2 of 4
Find the cookie set before the consent banner showed up
We load your page in a clean browser, capture every cookie set in the first 2.5 seconds, and tell you which ones are tracking users without consent.
The pre-consent problem regulators care about
GDPR and ePrivacy require that any non-essential cookie or tracker is blocked until the user actively opts in. A surprising number of sites get this wrong because their tag manager fires Google Analytics or Meta Pixel before the consent banner has rendered. Even with a Cookiebot or OneTrust banner installed, the underlying scripts are often loaded with the page rather than gated behind the consent decision. We simulate a fresh visitor with no prior consent state. Anything in the cookie jar after page load — that isn't strictly necessary — is a finding.
Security flags that quietly fail in production
Modern browsers reject cookies with SameSite=None unless the Secure flag is present. We flag these because they break silently — your auth might appear to work locally and fail for a percentage of users in the wild. Long-expiry cookies (over a year) are a soft GDPR signal: regulators have written guidance suggesting cookie lifetimes should be proportionate to purpose, and 13 months is the de-facto retention cap most DPAs accept.
Classification you can trust
Every cookie name is checked against an exact-match dictionary first, then a prefix list (so _ga_XXXX inherits Google Analytics's classification). Cookies we can't classify get a minor severity finding so a human can confirm them — better to surface the unknown than to silently call it 'necessary'.
Exemplo de achado
Pre-consent tracking detected
Cookie "_fbp" (Meta Pixel, marketing) was set before the user gave consent. The cookie was issued 1.2 seconds after page load, while the consent banner was still mounting. To resolve, gate the Meta Pixel script behind your consent management platform's "marketing" toggle.
Cookie : _fbp Domain : .example.com Category : marketing Set at : t=1.2s (banner not yet interacted with) Expiry : 90 days
Faça scan do seu site em 60 segundos
25 créditos grátis. Sem cartão de crédito. Achados reais na página que você se importa.