How the free scanner works
Last updated: October 10, 2026
The free scanner checks what a website does with cookies, storage and tracking before a visitor gives consent, and what changes after they accept. This page explains the method and the scoring, including the limits, so you can judge a score for yourself.
What happens during a scan
- A real browser visits the site. We use headless Chromium on Cloudflare’s network, with a normal desktop browser profile.
- Before consent: on the homepage we record:
- every cookie in the browser, including third-party cookies;
- every write to localStorage and sessionStorage;
- attempts at browser fingerprinting (canvas, WebGL, audio);
- every request to a domain other than the site’s own.
- The scanner accepts the banner. It recognises around 25 common consent platforms and otherwise clicks a button labelled like “Accept all”. If it finds no banner, that is reported.
- After consent: the same things are recorded again, then up to two more pages of the site are visited (3 pages in total).
- Each finding is labelled “before consent” or “after consent”. Only before-consent findings count against the score; after-consent activity is shown separately because it is how a site is supposed to work.
How cookies are identified
Each cookie is matched against our database of more than 9,000 known cookies, which gives provider, category (necessary, functional, analytics, marketing) and purpose. Cookies we can’t match are shown as “unclassified”.
The score
Every site starts at 100. Each rule below deducts its points once, however many findings trigger it.
| Finding | Points | Applies to |
|---|---|---|
| No consent banner detected | −20 | all |
| Non-necessary cookies set before consent | −15 | all |
| Fingerprinting detected | −15 | all |
| Data written to browser storage before consent | −10 | all |
| Requests to third-party domains before consent | −10 | all |
| Third-party cookies set before consent | −10 | GDPR |
| Cookies that last longer than 365 days | −5 | GDPR |
| More than 20% of cookies unclassified | −5 | all |
| More than 10 distinct third-party domains | −5 | all |
Grades: A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 50, F below 50. The GDPR, ePrivacy and CCPA scores use the rules marked “all” plus the rules for that law.
Limits you should know about
- Three pages. A problem that only exists deeper in a site can be missed.
- Location. The free scan doesn’t always browse from the EU. Sites that only show their banner to EU visitors can look like they have no banner. When we detect a consent platform but no visible banner, we say so.
- Automated acceptance. If our browser can’t find or click the accept button, after-consent results are incomplete.
- Bot protection. Some sites block automated browsers. If our browser can’t load the site, we fall back to a simpler check that can’t see storage, requests or fingerprinting, and the result says so.
- What counts as third-party. Any request to a domain other than the site’s own counts, including fonts and CDNs. Loading those before consent can still send visitors’ IP addresses to another company.
- No login. Pages behind a login aren’t scanned.
Scans in the CookieBoss dashboard
Scans run from the dashboard go further. They browse from the EU, test each consent state separately (reject all, accept all, and each category on its own) and cover more pages.
Shared reports
Each scan gets a private link you can share. Reports are not listed in search engines and are deleted after 90 days.