GDPR Cookie Scanner: How to Check Your Website Against the ePrivacy Directive

Most website owners think of cookie banners as a GDPR problem. Legally, they are mostly an ePrivacy problem. The GDPR tells you how to process personal data; the ePrivacy Directive tells you when you are allowed to touch a visitor's device in the first place. If your site drops a tracking cookie before the visitor clicks anything, you have broken the ePrivacy rules, no matter how polished your privacy policy is.

This guide explains what the ePrivacy Directive requires, which mistakes regulators keep fining, and how a GDPR cookie scanner helps you find those mistakes before a complaint or an audit does.

What the ePrivacy Directive says about cookies

The ePrivacy Directive (Directive 2002/58/EC, amended in 2009) is often called "the cookie law." The key provision is Article 5(3). In plain terms, it says:

Storing information on a user's device, or reading information that is already there, is only allowed if the user has given consent, unless it is strictly necessary to transmit a communication or to provide a service the user explicitly asked for.

Three details matter more than most people realise.

It is not only about cookies. Article 5(3) covers any storage of or access to information on the device: cookies, localStorage and sessionStorage, IndexedDB, tracking pixels, device fingerprinting, and SDKs in mobile apps. The EDPB confirmed this broad reading in its Guidelines 2/2023 on the technical scope of Article 5(3), which also cover URL and pixel tracking and other techniques that do not rely on classic cookies.

It is not only about personal data. Unlike the GDPR, Article 5(3) applies whether or not the information is personal data. "We don't store anything that identifies people" is not a defence.

The consent standard comes from the GDPR. Consent must be freely given, specific, informed and unambiguous, given through a clear affirmative action, and as easy to withdraw as to give. In Planet49 (C-673/17, 2019), the Court of Justice of the EU ruled that a pre-ticked checkbox is not valid consent.

Each EU country has transposed the Directive into its own law (for example § 25 TTDSG/TDDDG in Germany, Article 82 of the Loi Informatique et Libertés in France, Law 506/2004 in Romania), and national data protection authorities enforce it, often together with the GDPR.

What counts as "strictly necessary"

The exemption is narrower than many sites assume. Typically exempt:

• Session cookies for a shopping cart or login

• Load-balancing cookies

• Security cookies (fraud prevention, CSRF tokens)

• The cookie that stores the visitor's consent choice itself

• User-interface preferences the visitor actively set (language, accessibility) Typically not exempt, and therefore requiring consent:

• Google Analytics and most third-party analytics

• Advertising and retargeting pixels (Meta Pixel, Google Ads, TikTok, LinkedIn Insight)

• Social media embeds and share widgets that set cookies

• Session recording and heatmap tools (Hotjar, Microsoft Clarity)

• A/B testing tools that store identifiers

• Embedded YouTube videos in standard (non privacy-enhanced) mode Some regulators, notably the French CNIL, accept narrowly configured first-party audience measurement without consent. That is a national position with strict conditions, not a general exemption.

The cookie violations regulators fine most often

Cookie enforcement is one of the most active areas of EU data protection. The CNIL fined Google €150 million and Facebook €60 million in 2021 because refusing cookies took more clicks than accepting them, and in 2025 it fined Google €325 million and Shein €150 million over cookie and advertising practices. Smaller businesses are fined too, usually after a complaint from a visitor or a campaign by a privacy NGO.

The EDPB's Cookie Banner Taskforce (2023) documented the patterns authorities agree are unlawful. These are the issues we see most often when scanning websites:

1. Tracking before consent. Analytics or advertising cookies are set, or tags fire, as soon as the page loads, before the visitor has interacted with the banner. This is the most common and most serious violation.
2. No "Reject all" on the first layer. Accepting takes one click; refusing requires opening settings and unticking boxes.
3. Deceptive design. A bright "Accept" button next to a greyed-out "Reject" link, or a reject option hidden in body text.
4. Pre-ticked categories. Optional categories are switched on by default in the settings panel.
5. "Legitimate interest" for tracking. Using legitimate interest as the basis for advertising or analytics cookies, which Article 5(3) does not allow.
6. Consent ignored after "Reject". The visitor refuses, but the tags still load because the consent tool and the tag manager are not actually connected.
7. Cookie walls. Blocking access to the site unless the visitor accepts tracking.
8. No easy way to withdraw consent. No persistent link or icon to reopen preferences.
9. Inaccurate cookie declarations. The cookie policy lists cookies that no longer exist and omits ones that do.
10. Third-party resources leaking data. Fonts, scripts or images loaded from third-party servers before consent, transmitting the visitor's IP address. A German court fined a site operator in 2022 for loading Google Fonts this way. The hard part is that almost none of these problems are visible from the admin panel. Your consent tool may say "blocking enabled" while a hard-coded script in the theme fires anyway. That is why you need to test from the visitor's side.

What a GDPR cookie scanner does

A cookie scanner visits your website the way a real, first-time visitor would and records everything that touches the device and the network. A good scanner does more than list cookies. It tests behaviour across the consent lifecycle.

1. Cold load, no interaction. The scanner opens the page in a fresh browser with no stored data and records every cookie, storage entry and third-party request made before any click. Anything non-essential here is a likely Article 5(3) violation.

2. After "Reject all". It clicks reject and keeps observing. Tracking cookies or requests to ad and analytics endpoints that appear now mean your banner is decorative.

3. After "Accept all". It accepts and checks that consent actually unlocks the declared tools, which helps you verify your cookie declaration is complete.

4. Classification. Each cookie and request is matched to the service that set it (Google Analytics, Meta, Hotjar, and so on), its purpose, its lifetime and whether it is first- or third-party. This turns a list of cryptic names like _ga, _fbp or IDE into something you can act on.

5. Banner checks. The scanner looks at whether a banner exists, whether reject is offered on the first layer, and whether the choice is clearly presented.

Why a real browser matters

Simple scanners just fetch the HTML and look for known script tags. That misses most real-world problems: cookies set by JavaScript after the page renders, tags injected by Google Tag Manager, third-party scripts that set their own cookies, and storage written to localStorage. A scanner that runs a full headless browser (such as Chromium via Playwright) sees what an actual visitor's browser sees.

How GDPR Fix scans your site

GDPR Fix was built to answer one question quickly: is this site doing anything to a visitor's device that it shouldn't?

• Real browser scanning. Every scan runs in a real headless Chromium browser, so JavaScript-set cookies, tag manager tags and third-party scripts are all captured.
• Pre-consent detection. We highlight exactly which cookies and trackers load before the visitor makes a choice, the issue regulators care about most.
• AI-assisted cookie classification. Cookies are matched against a knowledge base that grows with every scan, with AI classification for unknown cookies, so you get the vendor, the purpose and the category instead of a raw name.
• A clear diagnosis for free. You see whether your site has a compliance problem before you pay anything.
• Concrete remediation. The full report tells you what to change: which script to block, which tag to tie to consent, which setting to fix in your consent tool.
• Pay per scan, no subscription. Scan when you launch, after a redesign or when you add a new marketing tool. No monthly plan to forget about.

A practical checklist for ePrivacy compliance

Use this whether or not you use a scanner:

• No non-essential cookies, storage or third-party requests on first load
• "Reject all" is on the first layer and as visible as "Accept all"
• No pre-ticked optional categories
• Rejecting actually stops tags (test it, don't trust the settings page)
• Consent is recorded and can be demonstrated
• Visitors can change their choice at any time from every page
• Your cookie policy matches what the site really sets
• Google Consent Mode, if used, is configured so that no identifiers are stored before consent
• Fonts and other assets are self-hosted or loaded only after consent
• You re-scan after every new plugin, tag, embed or redesign

What about the Digital Omnibus and the future of cookie banners?

You may have read that cookie banners are about to disappear. The reality is more cautious.

The long-planned ePrivacy Regulation, meant to replace the Directive, was withdrawn by the European Commission in 2025 after years of deadlock. In November 2025 the Commission instead proposed the Digital Omnibus, which would have moved the cookie rules into the GDPR as a new Article 88a, added new consent exemptions and introduced automated browser privacy signals.

During 2026 the Council reshaped that proposal significantly. Its negotiating mandate, agreed by EU ambassadors on 21 October 2026, keeps the cookie rules inside a rewritten Article 5(3) of the ePrivacy Directive rather than moving them into the GDPR. It lists a limited set of purposes that would not need consent, including first-party aggregated audience measurement and technical security, and would require sites to wait at least four months before asking again after a refusal. The browser-signal mandate was dropped.

What this means for you today:

• Nothing has changed yet. The Council and the European Parliament still have to negotiate a final text, and the current Council text gives member states time to transpose the rules after adoption.
• The core rule stays. Every version on the table still requires consent for advertising and cross-site tracking.
• Some low-risk analytics may become exempt in the future, but only under specific conditions. Until a final law is adopted and applies, the current Article 5(3) and its national implementations are what regulators enforce. A site that is compliant today will need minor adjustments under the new rules; a site that tracks before consent will be non-compliant under both.

Frequently asked questions

Is the ePrivacy Directive the same as the GDPR? No. The GDPR governs processing of personal data. The ePrivacy Directive governs access to the user's device and electronic communications. For cookies, ePrivacy decides whether you need consent; the GDPR defines what valid consent looks like and governs what you do with any personal data collected.

Does the ePrivacy Directive apply to non-EU websites? If your site targets visitors in the EU, EU regulators consider the rules applicable to you, and the GDPR's territorial scope reinforces this.

Do I need consent for Google Analytics? In practice, yes, in almost every EU country. A few authorities allow narrowly configured, privacy-preserving first-party analytics without consent, but standard Google Analytics does not meet those conditions.

Is a cookie banner enough? No. A banner is only the interface. Compliance depends on what your site actually does before and after the visitor clicks. That is exactly what a scanner tests.

How often should I scan? At minimum after any change to your tags, plugins, theme or embeds, and periodically (for example quarterly), because third-party scripts change their behaviour without telling you.

Does a clean scan mean I'm fully compliant? A scan shows what happens on the pages tested, from the location and conditions it tested. It does not review your privacy policy, contracts with processors or data retention. Treat it as strong technical evidence, not as legal advice.

Check your site now

The fastest way to know whether your website respects the ePrivacy Directive is to look at it the way a regulator would: as a fresh visitor who hasn't clicked anything yet.

Run a free compliance check on GDPR Fix →

---

This article is for general information and does not constitute legal advice. Requirements vary by country and change over time. For decisions about your specific situation, consult a qualified data protection professional.