Free heuristic tool

Audit a cookie banner

Enter a URL and the server will fetch the page's public HTML, or paste a page's HTML to run the same checks entirely in your browser. Either way you get a 0–100 score with plain-language findings.

Heuristic only:static markup analysis can't observe what scripts do at runtime, whether consent choices are honored, or whether a banner is geo-targeted. See the methodologyfor exactly what is (and isn't) checked.

JavaScript is required for this tool.

The auditor analyzes page markup in your browser or via a small API call; both need JavaScript. Please enable it and reload.

Website address

Our server fetches the page's public HTML (SSRF-hardened, 8 s timeout, 5 MB cap) and analyzes the markup. The HTML is not stored.

Declared vs Observed

Your consent platform declares one list of cookies. A browser records another. Import what the browser saw, paste what the platform declares, and see the gap. Everything runs on this device: nothing is uploaded, and raw cookie values are discarded as soon as the file is read.

Classification uses the bundled vendor cookie knowledge base 2026-10-20.1.

Your site host (for example example.ca)Import a HAR file or cookie JSON exportHAR from DevTools (Network, Save all as HAR) or a cookie export JSON. Maximum 10 MB.Or paste the HAR / cookie JSON herePaste your CMP declaration (cookie names, one per line, CSV, or JSON)Export or copy the cookie list from your consent platform. Names only.

Three checks to run in your own browser first

Reject still fires?

Fresh profile, load your site, click Reject All, then reload. In DevTools, Network and Application, note anything that still fires or persists.

Test result

Is _ga stable?

Note the _ga identifier in Application, Cookies before consent. Accept, reload, and compare. A changed value means the platform is wiping and recreating the cookie, which breaks attribution.

Test result

g/collect before consent?

Fresh profile, do not touch the banner. Filter Network for g/collect. A hit before any choice means measurement data left the browser before consent, cookie or no cookie.

Test result

How to read your score

The score is a weighted sum across five categories –banner presence (25), consent platform (20), consent-model quality (20), pre-consent loading (25), and policy links (10) – graded A (90+) to F (below 60).

A low score is a triage signal, not a verdict: “no banner detected” on a site with no non-essential cookies may be fine, while a high score never proves the CMP is configured correctly or that consent records exist. Each category explains what was found and what's missing; start there.

Want the badge for your own site, or the full criteria? Embed kit· Methodology

Run the audit

Declared vs Observed

Reject still fires?

Is _ga stable?

g/collect before consent?

How to read your score