Cookie Check
A cookie banner alone does not protect you. What matters is what happens in the background before anyone clicks “Accept”. Our check visits your website like a new visitor and shows you every cookie and every tracking service that is already active before the click. Then it clicks “Reject” and checks whether everything really stays quiet.
The page is loaded in two real browsers without existing cookies, once with “Reject” and once with “Accept all”. This takes about 30 to 50 seconds.
How to read the result
We load your page in a fresh browser without stored data and wait until all scripts have loaded. Then we read out all cookies, local storage entries and connections to third-party servers and match them to known services.
The traffic light
- OKThis point is implemented correctly.
- ReviewNot an acute error, but room for improvement.
- ProblemLikely has a negative effect and should be fixed.
- InfoFor information, without rating.
Tracking cookies before consent
Statistics and marketing cookies, for example from Google Analytics, the Meta Pixel or LinkedIn, may only be set after active consent. If we find such cookies on the first visit, they are marked red, with provider, purpose and lifetime.
Connections to tracking services
Merely loading a tracking script transfers the IP address to the provider, even before a cookie is set. We show every service contacted, grouped by provider. Google Tag Manager on its own measures nothing and is marked yellow; what matters is which tags it fires before consent. Google tags that only report “denied” without cookies (Consent Mode) are also yellow.
External embeds
Maps, videos (including YouTube in privacy-enhanced mode), captchas, chat and review widgets and other font services from third parties are marked yellow. They are usually not tracking in the narrow sense, but they also transfer data and generally require consent or a privacy-friendly integration. Google Fonts loaded from Google servers are red, exactly as in our Google Fonts checker. Fonts that only an embedded map or reCAPTCHA loads count as part of that embed.
Cookie banner and all cookies
We detect common consent tools and check whether a banner appears on the first visit. We also list all cookies that are already set on the first visit.
After “Reject”
In a second, fresh browser we click “Reject” or “Necessary only”, via the settings if necessary, and then load the page once more. If statistics or marketing cookies or connections to tracking services still appear, they are marked red, with a list. If we find no button to reject, we honestly report it as “could not be tested”.
After “Accept all”
Finally we accept everything and list every cookie and every service that is then loaded, with provider, purpose and lifetime. This is a good basis for the cookie list in your privacy policy and in your consent tool, and you can also download it as a table.
Banner fairness
Is “Reject” already available on the first layer and just as visible as “Accept”? We measure both buttons: size, font, contrast and whether one is styled as a mere text link. We also check whether categories are ticked in advance and recognise pay models (“pay or OK”).
Why the moment before the click matters
Cookies that are not technically necessary require prior, voluntary consent. In Austria this is governed by Section 165 of the Telecommunications Act 2021, in Germany by Section 25 TDDDG, both based on the European ePrivacy Directive and supplemented by the GDPR. The key word is “prior”: what happens before the click counts.
In practice, the error is often not in the banner but next to it. Google Tag Manager fires tags before consent has been requested, a plugin brings its own tracking, or an embedded video sets cookies without being registered in the consent tool. From the outside, everything looks correct.
Data protection authorities and consumer organisations increasingly check websites automatically, exactly for these points. Properly configured consent management protects against complaints and builds trust, because visitors really do have a choice.
Frequently asked questions about the cookie check
Which cookies are allowed without consent?
A cookie is marked as “unknown”. What now?
Does the check also test what happens after clicking “Reject”?
My website sets no cookies. Do I still need a banner?
Why is an inconspicuous “Reject” button a problem?
Does the check replace legal advice?
Is my input stored?
Related tools
Google Fonts Checker
Shows whether your website loads fonts from Google servers and thereby transfers IP addresses without consent.
Third-Party Checker
Shows every external service your website loads on the first visit, with provider, headquarters and data volume.
Tracking & Conversion Checker
Checks Google Ads, Analytics, LinkedIn and Meta before and after consent, including Consent Mode v2 and click IDs.
Imprint Check (Austria)
Finds your imprint and checks whether the mandatory information under Austrian law is complete.
Consent management that actually works
We set up your cookie banner so that tracking only starts after consent, including in Google Tag Manager and for embedded content. Afterwards we verify the result with exactly this tool.
Get in touch