foomworks. an autonomously operated software workshop

GDPR · CCPA · ePrivacy · cookie-consent scanner

Privacy & Cookie Checker

A URL in, the observable privacy signals out — a free, honest privacy and cookie-consent scanner for site owners, privacy and marketing teams, agencies and AI agents. Each finding is tied to GDPR, CCPA/CPRA or ePrivacy with a fix. No account, no API key.

Run a sample scan →

Swap the url= for your own page. Prefer the command line or an agent? See calling it over HTTP and the MCP server below.

What it does

  1. 01

    The observable privacy signals, named and explained

    Give it a URL; it returns the privacy signals a static-HTML scan can see — which known third-party trackers are present (Google Analytics/Tag Manager, Meta Pixel, TikTok, Hotjar, Clarity, LinkedIn and more), whether a consent-management platform / cookie banner is present, whether a privacy-policy link and a CCPA "Do Not Sell or Share" link exist, cookie attributes, and HTTPS — each tied to GDPR, CCPA/CPRA or ePrivacy with a plain how-to-fix. No account, no API key.

  2. 02

    Honest about what it cannot catch

    Static HTML can see that a tracker script is present, but NOT whether it actually fires BEFORE the user consents — the behaviour regulators fine for. That needs a real browser watching the network and cookies. Every result says so, flags the risk (e.g. trackers present with no consent tooling), and is explicitly NOT a determination of GDPR/CCPA/ePrivacy compliance. We never return a "compliant" verdict or a score — the deliberate opposite of consent-banner vendors that sell a widget as "compliance."

  3. 03

    Polite by design, and agent-native

    It honors the origin's robots.txt for our user-agent, identifies honestly, and does a single read-only GET — it never spoofs a browser, rotates proxies, or bypasses anti-bot, CAPTCHA or paywalls. Beyond plain HTTP it speaks the Model Context Protocol, so an MCP-capable agent can install scan_url_privacy as a native tool.

Why "honest" matters here

Cookie-banner and "consent management" vendors sell a widget as "compliance." But regulators do not fine the absence of a banner — they fine trackers and cookies that fire before the user consents, opt-outs that are not honored, and privacy notices that do not match what the site actually does. The headline fines of 2023–2025 (a €150M CNIL penalty against a fast-fashion retailer over cookies, and a wave of California CCPA enforcement over the privacy-policy-versus-practice gap) all turn on behaviour a banner alone does not fix. This checker draws that line out loud:

  • It reports the observable signals it finds, each tied to a specific regulation.
  • It states, on every scan, what static testing cannot evaluate — above all, whether trackers fire before consent, which needs a real browser.
  • It never returns a "compliant" verdict or a score. A clean scan is a starting point, not a certificate.
  • It is not legal advice; confirming compliance needs a browser-based pre-consent scan and review by a qualified professional.

What it checks

The static-HTML signals — the observable, render-independent facts:

  • Trackers without consent tooling GDPR / ePrivacy Known third-party trackers are present but no consent-management platform / cookie banner was detected.
  • Privacy-policy link GDPR / CCPA No link to a privacy policy or notice was found on the page.
  • "Do Not Sell or Share" link CCPA / CPRA Advertising/analytics trackers are present but no CCPA opt-out / "Your Privacy Choices" link was found.
  • Cookie attributes ePrivacy Cookies set on the response without a Secure and/or SameSite attribute.
  • HTTPS GDPR / ePrivacy The page is not served over HTTPS, so data and cookies travel unencrypted.
  • Mixed content ePrivacy Subresources loaded over plain http:// on an https page.

It recognises common trackers (Google Analytics/Tag Manager, Meta Pixel, TikTok, Hotjar, Clarity, LinkedIn, Segment and more) and consent platforms (OneTrust, Cookiebot, Osano, Usercentrics, Didomi, iubenda and more). It does not load the page in a browser, so it cannot confirm pre-consent tracker firing — a deeper, browser-based scan is on the roadmap.

Call it over HTTP

A plain GET from anything that speaks HTTP.

1 · Scan a page

curl 'https://privacy-scan.foomworks.workers.dev/scan?url=https://example.com/'

You get JSON: the resolved url, what was detected (trackers, consent tooling, HTTPS), a summary, the findings (each with its ruleId, regulation, impact, count and howToFix), the coverageNote and the disclaimer.

2 · Just the summary

curl 'https://privacy-scan.foomworks.workers.dev/scan/preview?url=https://example.com/'

What was detected plus the top issues — a quick gauge before the full report.

Install it as an MCP server

The checker speaks the Model Context Protocol over Streamable HTTP at POST /mcp, exposing two free tools — scan_url_privacy and scan_url_privacy_preview. Point an MCP-capable client at the endpoint and the tools appear automatically: 

# List the tools the server offers
curl -s -X POST https://privacy-scan.foomworks.workers.dev/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

The descriptor is at /.well-known/mcp.json and an OpenAPI description at /openapi.json.

Endpoints

All free — no account, no API key:

  • GET /scan?url= free Scan a URL and return the privacy findings, what was detected, an honest summary, the coverage note and the disclaimer.
  • GET /scan/preview?url= free What was detected plus the top issues only — a quick look.
  • POST /mcp free MCP server (Streamable HTTP, JSON-RPC 2.0): the scan_url_privacy / scan_url_privacy_preview tools.
  • GET /.well-known/mcp.json free MCP server descriptor for automatic discovery.
  • GET /openapi.json free OpenAPI 3.1 description of the public surface.
  • GET /policy free The acceptable-use policy and the honesty/coverage statement, in full.
  • GET /health free Service status and the number of trackers / consent tools known.
  • GET /stats free Daily usage counters.

Live

Try it now

Everything above is free and needs no setup — run a scan on your own page, or install the MCP server and let an agent check pages for you.

Run a sample scan →

New to cookie consent? Start with the GDPR & CCPA cookie-consent checklist.

Privacy & Cookie Checker is built and maintained by an autonomously operated software workshop under human oversight. It performs automated static-HTML testing, which sees only observable signals; it cannot confirm whether trackers fire before consent, and results are not a determination of GDPR, CCPA/CPRA or ePrivacy compliance and are not legal advice. It reads only public pages you are entitled to read, honoring each site's robots.txt. Provided as-is. No affiliation with, or endorsement by, any regulator or any site you scan is implied.