Can You Trust a Free Cookie Scanner?

What we tested, in one page

Four experiments, all run on the same day. First, every scanner against a public test site we built with planted violations, to see who catches what. Second, we collected what the vendors' own scanners say about the vendors' own websites. Third, we pointed all 11 tools at consentstack.io, a site we can verify is clean, and read what they flagged; we also ran our own two-region scanner across all 12 vendors' sites. Fourth, we ran every tool a second time within the hour to test repeatability, and separately fed each one a tagged URL on a logging endpoint we control to measure where it scans from and whether it executes JavaScript.

The test they failed

We built a public test site that breaks consent law on purpose: Google Analytics fires before any consent choice, and a TikTok pixel deliberately keeps firing after the visitor clicks Reject. Catching those two behaviors is the entire job of a compliance scanner. 4 of 11 caught the pre-consent fire. 1 of 11 clicked the banner at all. 0 of 11 caught the tracker that kept firing after Reject. That last miss is the costly one: in our census of 229 live sites, nearly half of the banner sites where Reject could be clicked kept a tracker firing afterward. A scanner that never clicks Reject is blind to the most common real-world violation.

Graded from each tool's own output, September 1, 2026. Osano is not in this table because its email-gated report never arrived. Our own scanner ran against the same rig and is graded on the same seven tests, alongside the grading rules and per-tool screenshots, in the full results matrix.

What their scanners say about their own websites

The rig, at least, is our creation. This next table needs no instrument of ours at all: it is each vendor's own tool, pointed at the vendor's own site, in the vendor's own words.

Collected September 1, 2026 with screenshots on file. The remaining vendors either offer no self-scannable tool or, in Cookiebot's case, no self-scan appeared in our capture set, so no claim is made about them here.

Then we pointed all 11 at our own site

Fairness cuts both ways, so we ran every tool against consentstack.io and published what came back. The short version: no tool, from any location, found a third-party tracker firing before consent on our site. Every flag raised was one of our consent system's own first-party cookies, a display preference, or a parser artifact. The largest number on the table, Termly's 49 cookies, is not a flag at all: Termly's scanner is an inventory that lists and categorizes what it finds without judging any of it.

Since several tools flagged them, here is exactly what our pre-consent first-party cookies do. The consent system's own state (the cookies that remember whether and how you consented, plus a storage-availability test key) must exist before consent, the same way every consent tool's does, or the choice could not be remembered. The theme cookie stores a light-or-dark display preference and contains no identifier. And consentstack_anon_id is a first-party pseudonymous identifier we use to count unique visitors for plan billing; it is hashed server-side and never sent to any third party. All three are disclosed in our privacy policy, and none of them is a third-party tracker.

Our scanner on the 12 vendors' own sites

The scanning went both directions: we ran our two-region scanner across the websites of all 12 consent vendors. 11 of the 12 fired something before consent in the EU test. The twelfth, cookie-scanner.com, passes trivially: its homepage runs nothing that needs consent. Findings are reported per phase, the way the law reads, rather than as a single score.

All scans September 1, 2026, each traceable by the scan id shown. "Fired before consent" means at least one request or cookie that needs consent was recorded before the banner was answered in the EU test. "Tracking continued after the choice" means at least one tracker or tracking cookie was still active after the visitor's consent decision in the region shown. consentmanager.net limited our crawl, so its full verdict is withheld rather than guessed. The "blocks N items in the US" notes are the opposite failure mode, stricter than US law requires; we report them but do not count them as violations, and the same rule is applied to every site our scanner tests.

Two rows deserve a sentence each. UniConsent's own banner offered no reject option in either region, on the website of a company whose product is consent. And piwik.pro runs Cookie Information, a competitor's consent tool, on its own site. We note both without speculating about why.

This table is 12 sites on one day. How each consent tool behaves across its wider installed base is a separate question, answered at scale in Cookie Compliance by Consent Tool.

Run it twice

A measurement you cannot repeat is an anecdote. So we ran every tool against consentstack.io a second time within the same hour, changing nothing. Three of the eleven gave a different answer. One of them, consentmanager's crawler, produced a high-risk verdict and a passing verdict sixteen seconds apart, and the run that found 48 cookies passed while the run that found 6 failed.

One caution the other way: consistency is not correctness. CookieScript was perfectly repeatable at zero cookies on a site that sets cookies. CookieHub reproducibly reported setItem, the name of a JavaScript method, as a cookie. cookie-scanner.com reproducibly printed "No banner found" and "Banner clicked: Yes" in the same report. Stable and right are separate tests, and a tool needs to pass both.

Two runs is a floor, not a distribution, so we say "in our two runs" and no more. Piwik PRO's rescan returned a byte-identical report with an identical generation timestamp, so its repeatability is untested rather than proven.

Where does a scanner scan from? None of them say

Scan location is not a detail. EU law is opt-in and most US law is opt-out, so a correctly configured site behaves differently for the two visitors: it must hold everything until consent in the EU, and it may lawfully run analytics until the visitor opts out in most of the US. A verdict from an undisclosed location is therefore uninterpretable, and none of the 11 tools disclose where they scan from.

So we measured it. We stood up a logging endpoint on a domain we control, gave each tool a tagged URL, and recorded the origin of every request. Four tools could be tagged cleanly:

Credit where due: the four we could tag do scan from Europe, even if they never say so. The rest resisted measurement in instructive ways. Cookiebot and Usercentrics appear to normalize the URL and strip our tag before crawling, so URL tagging cannot attribute them. And consentmanager needed no probe at all: its own report prints a map of crawl origins, showing Canada and the United States. A crawler that grades sites against EU law, operating from North America, by its own disclosure.

For contrast, our scanner's vantage is part of the result: every scan runs once from Frankfurt, Germany and once from a California IP address, and the two regions get separate verdicts.

How to tell an instrument from a marketing asset

Every free scanner report we collected, including the ones that contradicted themselves, ended at the same place: that vendor's signup button. We will not guess at anyone's motives. We will give you the six questions this study asked, so you can grade any scanner yourself, ours included.

And here are our own answers, stated so you can check them rather than trust them:

How we tested

All runs happened on September 1, 2026. The 11 tools are the free, publicly accessible scanners of Cookiebot, CookieYes, CookieServe, CookieScript, cookie-scanner.com, CookieHub, consentmanager, Usercentrics, Piwik PRO, UniConsent, and Termly. Osano's scanner is email-gated and its report never arrived, so it appears only as a no-result. Each tool was run by a human in a browser, the way a site owner would use it, and every report was captured as a screenshot at the time of the run.

The rig test and its planted violations are documented in full, with per-tool screenshots, in the scanner comparison. The 12 vendor-site scans ran on our production scanner, one scan id per row above; the scanner loads each site from Frankfurt and from a California IP, clicks Accept and Reject, and records findings per phase. The repeatability pass re-ran every tool against consentstack.io within the same hour. The vantage measurement served each tool a tagged URL on a logging endpoint we control and recorded the country, network, and JavaScript execution of every request; untagged requests from unrelated crawlers were discarded, and tools that strip URL parameters are reported as unmeasurable rather than guessed at. Every observation table on this page is also available as a CSV download; the rig-test matrix has its own.

One correction from during the study, published rather than buried: our scanner initially reported "no banner found" on four of the twelve vendor sites. A manual browser check showed two of them displaying real banners, and the other two loading their consent tools but suppressing the banner for non-EU visitors. The cause was on our side: our detector lacked fingerprint signatures for those four vendors' consent tools. We shipped the signatures the same day, re-scanned all four, and every number on this page comes from the corrected scans.