The TruePrivacy cookie scanner audits your website the way a real visitor’s browser experiences it. Instead of parsing static HTML, it drives a real headless browser through your pages and captures everything that actually runs at runtime.
Cookie scanner results showing detected cookies and trackers

​
What a scan does

1

Crawl

Starting from your site URL, the scanner follows same-origin links and crawls up to 25 pages (default 10). Only pages on your own origin are visited.
2

Capture

On each page, the scanner records real runtime artifacts:
  • Cookies — first-party and third-party, with domain, path, expiry, and flags
  • localStorage and sessionStorage entries
  • Tracking scripts — analytics and tag-manager JavaScript
  • Pixels and beacons — 1×1 images and network beacons used for tracking
3

Classify

Every artifact is matched against TruePrivacy’s database of ~75 known trackers — Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, LinkedIn Insight, TikTok Pixel, and more — and assigned a provider, purpose, and suggested consent category.

​
Classification details

  • First-party vs third-party is determined using the registrable domain (eTLD+1), not a naive hostname comparison — so analytics.example.com on www.example.com is correctly first-party, while doubleclick.net is third-party.
  • Cookie expiry is humanized: raw expirations become readable durations like “Session”, “1 hour”, “30 days”, or “2 years” — the same values shown in your public cookie declaration.
  • Unknown cookies are reported as unclassified so you can assign them to a category manually.

​
Scan engines

EngineWhen usedFidelity
browserDefault — full headless browserFull runtime capture: cookies set by JavaScript, dynamically injected tags, pixels, storage
fallbackNo browser available in the scan environmentBasic HTML scan: statically declared scripts and cookies only
The engine used is reported on every scan result, so you always know the fidelity of the data you are looking at.
Fallback scans cannot see cookies set by JavaScript after page load — which is how most modern trackers work. Treat fallback results as a lower bound, not a complete inventory.
Only public, resolvable websites can be scanned — internal and private network addresses are always rejected. See Security & Trust.

​
Next steps

Running scans

Trigger scans from the dashboard and review results.

Scheduled scans

Automate scans and get alerts on new trackers.