I have a Cookiebot banner. Why is this saying I'm not compliant?

Because GTM or Google Analytics is hard-coded in your HTML and fires before Cookiebot initialises. Move those tags into Cookiebot's blocking list, or into GTM with consent mode enabled.

Is just having a banner enough?

No. The banner has to actually block scripts until the user clicks accept. A banner with no enforcement is the most common compliance failure pattern — and the one regulators specifically target.

Does this check actual cookies being set in the browser?

No — we analyse static HTML only. For actual cookie inspection, use Chrome DevTools (Application > Storage > Cookies) after clicking "reject" on the banner.

What about Cloudflare Web Analytics or Plausible — are those exempt?

Cookieless analytics that don't store or read device info are generally exempt from ePrivacy consent requirements. We don't flag Plausible, Fathom, or Cloudflare Web Analytics.

I'm US-only. Does this matter to me?

Yes — CCPA, CPRA, Virginia's CDPA, Colorado's CPA, and California's newer ADPPA all impose similar (often stricter) requirements. The "we're US-only" defence stopped working in 2023.

Free Tool

Updated 6 June 2026

Cookie Compliance Checker

Detect whether a site has a cookie consent banner, identify the consent tool used, and check if tracking scripts load before consent (GDPR violation).

By Deepak Shukla — Founder & CEO, Pearl Lemon

Enter a URL

What This Tool Checks

Whether a cookie consent banner is present
Which consent tool is used (Cookiebot, OneTrust, TrustArc, CookieYes, Termly, Osano, Iubenda, Quantcast, etc.)
Tracking scripts present on the page (Google Analytics, Meta Pixel, GTM, Hotjar, etc.)
Whether tracking scripts load BEFORE consent (the actual GDPR violation)
Per-script load order so you can see the sequence

Why This Matters

Having a cookie banner is not GDPR compliance. The banner has to actually BLOCK tracking scripts until consent is given — and most don't. Regulators (CNIL, ICO, DPC) have fined dozens of large brands in 2024-2025 specifically for tracking-before-consent, with fines starting at €100k and reaching €270M (Google). This tool surfaces exactly which scripts fire before consent — the precise evidence a regulator would use against you.

How to Fix Issues

1.Configure your consent tool to BLOCK third-party scripts by default — most are misconfigured to "notify only"
2.Use GTM's consent mode (or your consent tool's tag-blocking API) to gate every analytics/ad/tracking tag behind explicit consent
3.Move all marketing scripts (Meta Pixel, LinkedIn Insight, TikTok Pixel, etc.) into GTM and gate them via the consent platform
4.For server-side tagging, ensure your server-side GTM respects consent state from the client
5.Test compliance with the EU EDPB's "Cookie Banner Taskforce" report criteria — anything less is risk

The cookie-banner industry is built on a lie: that having a banner equals compliance. It doesn't. The GDPR, the ePrivacy Directive, and the equivalent laws in the UK, California, Brazil, and 20+ other jurisdictions all require the same thing: non-essential cookies must be blocked until the user actively consents. Almost no one does this correctly.

What the law actually says

GDPR Article 7: consent must be "freely given, specific, informed, and unambiguous."

ePrivacy Article 5(3): storing or accessing information on a user's device (cookies, localStorage, fingerprinting) requires prior consent for anything not strictly necessary.

EDPB guidance (2023): pre-checked boxes are invalid consent. "By using this site you agree" banners are invalid consent. "Reject all" must be as easy as "Accept all." Tracking scripts must NOT load until consent is given.

What we measure

We fetch the page HTML and look for two things in tension:

Presence of a known consent tool — we recognise the top 10 platforms (Cookiebot, OneTrust, TrustArc, CookieYes, Termly, Osano, Iubenda, Quantcast Choice, CookieConsent, GDPR Cookie Compliance plugin). If we find one, we report which.
Tracking scripts in the HTML before the consent script — Google Analytics, GA4, Google Tag Manager, Meta Pixel, LinkedIn Insight, TikTok Pixel, Hotjar, Mixpanel, Segment, Amplitude, Fullstory. If any of these appear in the HTML before the consent tool initialises, you have an issue.

The two failure modes we catch

Failure A: No consent tool at all, tracking scripts present. Hard violation. Every EU user is being tracked without consent. Fine risk: high.

Failure B: Consent tool present, but tracking scripts hard-coded in the HTML before it. This is the most common failure pattern. The consent banner shows; the user clicks "reject"; but the scripts already loaded and fired. The banner is decoration. Fine risk: high.

Pass: Consent tool present, all tracking scripts deferred (loaded conditionally via GTM consent mode or the consent tool's API). This is the correct pattern.

What this tool can't detect (yet)

We don't execute JavaScript — we analyse static HTML only. That means:

Scripts injected dynamically by the consent tool after consent are invisible to us (which is fine — they're post-consent, not a violation)
Server-side tracking (Cloudflare Web Analytics, server-side GTM) is invisible
Cookies actually set in the browser are invisible (use Chrome DevTools "Application > Storage" for that)

But the most common violation — tracking scripts hard-coded in the HTML — is exactly what we catch.

Why this matters more than ever in 2026

Privacy regulators have moved past warnings into active enforcement. The CNIL alone has fined: Google (€150M), Facebook (€60M), Amazon (€35M), Microsoft (€60M), TikTok (€5M), all primarily for cookie/consent violations. Smaller companies are increasingly targeted — 2024 saw fines against German publishers (€500k-€2M) and UK retailers (£200k-£1M) for the exact failure modes we detect. The downside of getting this right is small; the downside of getting it wrong is existential.

Methodology

We fetch the URL with a 12-second timeout and User-Agent: SiteMonitorBot/1.0. The returned HTML is analysed for two pattern sets. First, we scan for consent-tool fingerprints: regex matches against known script src URLs and global variables for Cookiebot, OneTrust (Optanon), TrustArc, CookieYes, Termly, CookieConsent, Osano, Quantcast Choice (__cmp), Iubenda, and the GDPR Cookie Compliance WordPress plugin. The first match wins (banners rarely coexist). Second, we scan for tracking-script fingerprints: GA Universal, GA4, GTM, Meta Pixel, LinkedIn Insight, TikTok Pixel, Hotjar, Mixpanel, Segment, Amplitude, Fullstory, etc. For each match we record its position (load order) in the HTML. Compliance verdict: is_compliant = true only when either (a) no tracking scripts are present, or (b) a consent tool is present AND no tracking scripts appear before the consent tool's script tag. Otherwise we flag the violation and list which scripts loaded prematurely. We do not execute JavaScript — this is a static-HTML analysis, which catches the most common violation pattern (hard-coded tracking tags) but cannot detect dynamic injection.

Frequently Asked Questions

This tool also answers

How do I check what cookies a website sets?

The scan loads the page and lists every cookie set before any consent is given, along with its name, domain, expiry and whether it is first- or third-party — which is exactly the set regulators treat as non-essential tracking.

Monitor this continuously with LemWatch

A one-off free cookie consent & gdpr compliance checker shows you today. LemWatch re-runs the same checks around the clock and alerts you the moment something breaks — free for up to 10 sites, no card needed.

Related Free Tools

Verify that a site has a Privacy Policy, Terms of Service, Cookie Policy, and Imprint. Detects missing legal pages — a hard requirement under GDPR, CCPA, and most jurisdictions.

Third-Party Scripts

Find every third-party script on your page. Measure bytes, blocking time, and which ones are killing INP.

Meta Tags

Extract and validate meta tags from any URL — title, description, Open Graph, Twitter Cards, and more.