Scan your site's consent banner
Invite-only for now. The Scanner is currently open only to site owners and agencies we have invited. If you have not been invited, you can still read how it works below; to ask for access, write to [email protected].
The Scanner loads the public homepage of a website twice, each time in a fresh browser session, from a server in Germany, after checking robots.txt as CookieTelemetryBot. The visits themselves use an unmodified headless Chromium browser, whose user agent identifies it as automated ("HeadlessChrome") but not as ours; our bot information page explains why. It does not click, accept or reject the consent banner. It lists third-party network requests that occurred in both visits before any interaction with the banner, as matched by the EasyPrivacy filter list and our own list. It reports technical observations from those two visits only. It does not assess legal compliance, and it is not legal advice, an audit or a certification.
This is a verified-owner tool: the result is private, and we only show it to someone who has proven they control the domain. See our Scanner Terms of Service and Scanner Privacy Policy.
Step 1 — submit your domain
Step 2 — prove you control the domain
Depending on what you picked above, you'll be asked to do one of:
- DNS TXT record: add a TXT record at your domain's root with the value we give you (format:
cookietelemetry-verify=<token>), then confirm. DNS propagation can take a few minutes. - Meta tag: add
<meta name="cookietelemetry-verify" content="<token>">to your homepage's<head>, then confirm. - Email at the domain: we send a confirmation link to an address at the domain you're scanning (an address ending in @ followed by that same domain). Free-mail addresses (Gmail, Yahoo, etc.) can't be used to verify a different domain.
Step 3 — get your private result
Once you verify, we run the two-visit scan and show your private result on this page. If you verified by email, we also send the private link to that address. Nobody else, including search engines, sees anything about your domain — only: "This report is private. Verify that you control this domain to see it."
Limits
- Up to 2 scan requests per domain and 5 per IP address in any 24 hours, and 60 across all users per hour.
- Results are deleted after 7 days; requester emails after 30 days.
- If a site blocks or challenges our visit, we report "site declined the scan" — we never retry through another identity or IP.
How matches are made
Matching uses the EasyPrivacy filter list (© The EasyList authors, GPLv3 / CC BY-SA 3.0) and our own list. Detail rows for a result show the matched rule and list version.