Cookie Checker: GDPR Flags & Tracker Audit
Reads all Set-Cookie headers from a website's homepage, checks the Secure, HttpOnly and SameSite flags and detects typical tracking cookies (Google Analytics, Facebook Pixel, etc.). Relevant for site owners and privacy officers: tracking cookies set without consent are a GDPR risk, missing flags a security risk.
What does the cookie checker test?
The cookie checker loads your homepage and reads every cookie that gets set in the process. It checks the three important protection flags — Secure, HttpOnly and SameSite — and detects typical tracking cookies from services like Google Analytics or the Facebook pixel. You'll see right away whether your site loads tracking before any consent.
Why it matters
This is the most common compliance trap on the web. Under the GDPR and the ePrivacy rules — binding across the EU since the Court of Justice's Planet49 ruling in 2019 — tracking and marketing cookies may only be set after the visitor has actively agreed. If your site loads Google Analytics on the very first visit, that's a violation — and exactly the kind of thing competitors and consumer groups act on. On top of that, missing protection flags are a real security risk: without them, session cookies are easier to steal.
How to read the result
Strictly necessary cookies (for login or a shopping cart, say) are uncritical. The problem starts when tracking cookies appear before consent — those belong behind your consent banner. For the flags: Secure (HTTPS only), HttpOnly (no JavaScript access, which protects against theft via XSS) and SameSite set to Lax or Strict (protection against cross-site request forgery). If a session cookie is missing Secure or HttpOnly, fix it.
Frequently asked questions about Cookie audit
Do I need consent for every cookie?
No. Strictly necessary cookies are allowed; tracking and marketing cookies require the visitor's active consent.
What's the difference between necessary and tracking cookies?
Necessary cookies keep the site working (login, cart). Tracking cookies follow behaviour across sites and services for analytics and advertising.
What does the SameSite flag do?
It controls whether a cookie is sent on requests coming from other sites — Lax or Strict protects against CSRF attacks.
Can a website really be fined or warned over cookies?
Yes. Cookies set without valid consent are a common basis for warnings and can lead to cease-and-desist demands and fines.
Need the full audit? The full Webscan Radar security check combines Cookie audit with all other areas plus GDPR audit, CMS detection, CVE matching and performance measurement in one report — also free.