Is the cookie scanner really free?+
Yes — the scanner is free and does not require a signup. You enter a public URL, the scanner loads the page in a controlled browser, and you get a list of cookies, third-party requests, and tracking pixels detected before anyone clicks the cookie notice. The free scan is rate-limited per IP to keep the tool available; paid plans and the free trial add scheduled monitoring, the Reject / Accept test (what your site still sets after a visitor clicks Reject), and storage of historical scans for evidence purposes.
What does the scanner actually detect?+
Cookies set on the first page load (name, domain, expiry, secure/HttpOnly/SameSite flags), third-party hostnames the page contacts, and well-known tracking pixels and tags (Meta Pixel, Google Tag Manager, Google Analytics 4, LinkedIn Insight, TikTok Pixel, Hotjar, Microsoft Clarity, and others). The scan reflects what an unconsented EU visitor would experience — which is the relevant baseline under Article 5(3) of the ePrivacy Directive.
How is this different from the scanner my consent tool runs?+
When the same vendor runs the consent tool and the scanner, there is a structural conflict of interest: a clean scan is a sales argument for the consent tool. CookieSentry is an independent verifier, not a consent tool. We scan the live page from outside, you compare the result to what the consent tool claims, and the diff is your audit evidence. Most EU e-shops we have scanned in the run-up to launch show at least one tracker firing before consent — even on sites running a paid consent tool.
Is the scanner GDPR-safe to use on my own site?+
Yes, and for a third-party public site too. The scanner accesses the URL the same way a regular browser does: it loads the public page, observes the cookies and network requests, and discards the page after the scan. No personal data is collected from the visitor or the site, and the scanner does not authenticate, scrape gated content, or interact beyond a single page load (plus the Reject and Accept clicks on paid plans and the trial). Article 6(1)(f) legitimate interests covers the scanning activity for the controller running the audit.
Why do I see different cookies than the privacy policy on the site lists?+
That gap is the most common finding on EU e-shops, and it is the gap supervisory authorities cite in published transparency-notice decisions. The privacy policy was written once and the marketing stack changes every quarter — a new analytics tool, a new chat widget, a new ad pixel, a relaunched A/B testing platform — and the policy is rarely updated to match. The scan is the simplest evidence that the policy is out of date and which tools need to be added.
Does the scan tell me whether my site is GDPR-compliant?+
It tells you the most common compliance failure mode (non-essential cookies set before consent, in breach of Art. 5(3) of the ePrivacy Directive) and gives you the artefact list to update your privacy and cookie policies (Art. 13 GDPR). Compliance is broader than what one scan can prove — your ROPA, DPA, retention schedules, breach procedure, and lawful-basis mapping all matter — but the cookie / tracker side is where most regulator-visible failures live, and the scan turns it into a working list.
Can I scan a site behind a login or a paywall?+
No — every scan, free or paid, loads one public page, so logged-in flows, the customer dashboard and other gated areas are out of reach. For most marketing-stack questions the public homepage and a few category pages are enough; the gap that matters in audits is the unconsented public visitor.
Will the scan trigger Hotjar / Clarity / GA recordings on my site?+
Yes, exactly the same way a regular visitor would. That is the point — you are seeing what the analytics stack records about an unconsented EU visitor. If you do not want the scan in your dashboards, filter the visit out afterwards, for example by the time of the scan or by its user agent, which usually contains "CookieScanner".
How often should I run a cookie scan?+
Two cadences. Reactive: any time your marketing stack changes — new tag, new tool, new partner integration, or a quarterly review at minimum. Proactive: scheduled scans (paid plan) on the high-traffic pages plus the checkout, with a diff alert when a new third-party request appears. The cost of a regression is a regulator finding plus a forced privacy-policy update; the cost of a scheduled scan is negligible.
Do I get a downloadable report I can send to counsel or auditors?+
Yes. Every scan, free or paid, can be shared as a link or saved as a timestamped PDF report — the cookies, the third-party requests, the verdict at the time of scan, the page URL and the scan timestamp — that you can hand to counsel or an auditor as a record of what the page did at that moment.