Enter a URL. We fetch it via api/fetch-proxy.php and detect tracking scripts, consent management platforms (CMPs), Google Consent Mode, and policy links in the live HTML. No PHP backend? Use the manual checklist below.
Who uses this and why
Most WordPress sites add Google Analytics or the Meta Pixel and forget about it. If those load before the visitor opts in, that is the exact gap regulators act on. This scan tells you in seconds.
A banner is not the same as compliance. Many banners show up but never actually block the scripts until consent. The scan flags trackers and CMP together so you can check they work as a pair.
GDPR and the UK GDPR/PECR apply based on your visitors, not just your location. If EU or UK consumers use your site, consent rules apply, and fines are real.
Procurement and legal teams increasingly ask. Run the scan for a fast, honest baseline before you answer, then close the gaps it surfaces.
What GDPR and ePrivacy actually require for cookies
Two things drive website cookie rules in Europe: the GDPR, which governs personal data broadly, and the ePrivacy Directive (the "cookie law"), which governs storing or reading information on a user's device. Together they lead to one practical rule that trips up most WordPress sites: non-essential cookies and trackers, analytics, advertising pixels, embedded marketing scripts, must not run until the visitor has given informed, freely-given consent. Cookies that are strictly necessary for the site to function are exempt; almost everything in the marketing stack is not.
Consent has to mean something. It must be opt-in, not assumed, so no pre-ticked boxes and no scripts firing on page load. Rejecting must be as easy as accepting, a prominent "Accept all" with a buried "reject" is a dark pattern regulators have penalised. And you should keep a record of consent: what the user agreed to, when, and under which version of your policy. The UK follows a parallel regime (UK GDPR and PECR) enforced by the ICO, with the same core expectations.
Why a cookie banner is not the same as compliance
This is the single biggest misconception. Installing a consent banner does not make a site compliant if the banner does not actually block the scripts until consent, a design known as prior blocking. Plenty of WordPress sites show a banner while Google Analytics and the Meta Pixel have already loaded and set cookies before anyone clicked anything. That is why this tool checks two things together: which trackers are present, and whether a real consent platform is governing them. Trackers with no consent platform is the clearest red flag; trackers with a platform still needs verifying that the platform blocks rather than merely notifies.
What this scanner sees, and what it cannot
The scan reads the initial HTML of the page you enter and detects the fingerprints of common trackers (Google Analytics and Tag Manager, Meta Pixel, Hotjar, Clarity, LinkedIn, TikTok, and others), known consent management platforms (Cookiebot, OneTrust, CookieYes, Complianz, Borlabs, and more), Google Consent Mode, and whether privacy and cookie policies are linked. What it cannot see is equally important to understand: cookies set at runtime by JavaScript after the page loads, cookies delivered in server response headers, or what happens after a user interacts with a banner. So a clean result is reassuring but not proof, and a flagged result is a strong signal worth acting on. For a definitive picture you need a full audit that observes actual cookie and network behaviour, and for your legal obligations you need qualified advice.
Detecting the gap is easy; closing it correctly is the work
Spotting that trackers load before consent takes one scan. Fixing it properly, configuring a consent platform to block scripts until opt-in, wiring analytics to Consent Mode so you keep useful data lawfully, writing accurate privacy and cookie policies, and logging consent, takes real setup, and getting it subtly wrong (a banner that does not block, a reject button that does not work) leaves you exposed while looking compliant.
Digital Success sets up compliant consent, analytics, and privacy foundations for WordPress sites serving EU and UK visitors. Let us make your cookie and privacy setup genuinely compliant.
Frequently asked questions
What does GDPR require for cookies on my website?
Is this GDPR and cookie checker free? Is it legal advice?
Why does the tool say high risk when I already have a cookie banner?
What trackers and consent tools can it detect?
Does GDPR apply if my business is not in the EU?
Can Digital Success fix my cookie and privacy compliance?
This tool provides general, illustrative guidance for planning and does not guarantee results. The checklist is shown above so you can verify each item yourself. Last reviewed September 2026 by the Digital Success web & SEO team.
Make your cookie & privacy setup genuinely compliant
A banner is not compliance. Digital Success configures consent that actually blocks trackers until opt-in, consent-aware analytics, and accurate policies for WordPress sites serving EU and UK visitors. This is guidance, not legal advice.
Get my free privacy & consent reviewWant proof first? See how we grow ecommerce and content sites in our case studies.