Cookie Audit, test your site's consent, not just its banner

What the extension collects: nothing

An extension that reads a browser’s cookies owes you a plain statement of what it transmits, where and to whom. Before anything else.

• No data is sent to any server, neither mine nor anybody else’s. No telemetry, no account, no remotely loaded code.
• The cookie databases are bundled inside the extension, they are not queried online.
• The CSV, JSON and PDF exports are files created on your own computer.
• A cookie’s value is never displayed, exported or stored. Only its length is computed, to show the cookie’s size. Chrome’s interface hands that value over with every cookie and there is no way to decline it; it is never written anywhere. What is kept is the name, the domain, the expiry date and the technical attributes.
• From local storage, only the keys are recorded, never their contents.
• The only changes made are deleting the audited site’s cookies and clearing its local storage, strictly after your explicit confirmation, and never on a domain other than the one displayed.
• The only network connection made is opening the privacy policy page of the site you are auditing, when you ask for it.

The full detail, permission by permission, and what stays stored on your device, is in the extension’s privacy policy.

The consent test, in three guided steps

Step 1, clean state. The tool deletes the site’s cookies and clears its local storage, then reloads the page. Everything placed before your first click is recorded.

Step 2, refusal. You click Reject all in the site’s banner. The tool keeps observing and counts what is placed in spite of your refusal.

Step 3, acceptance. The same again after accepting everything, to measure the gap between the two states.

You are the one clicking in the banner, never the tool. An automated click is worthless as evidence of a user journey, and it would fail on one banner in two.

Three legal frameworks, suggested automatically

European GDPR, Quebec’s Law 25, Canada’s PIPEDA. The tool suggests the likely framework from the domain extension, a .qc.ca site not calling for the same rules as a .fr one, and you keep it or change it with one click.

Each cookie category then shows the matching consent status, with the article reference where one exists. The verdicts change with the framework: what counts as a gap in Europe may be only a point to check in Canada, where opt out is allowed under conditions.

An action plan, not just a diagnosis

Every gap comes with the concrete fix to apply. Four levels, gap observed, to be checked, possible exemption to justify, no gap, rather than a red or a green.

The report groups the actions specific to your site into a plan you can tick off, followed by what the law requires category by category, with the official references: France’s CNIL for Europe, the Commission d’accès à l’information for Quebec.

Your policy text, ready to paste

The tool drafts the “Cookies used on this site” section from what it actually observed: the table of cookies, their purposes, their lifetimes, the third party providers to mention. One button copies the whole section, as text or as HTML. Anything you need to complete yourself is marked in brackets.

That is the difference between a tool that tells you that you have a problem and a tool that hands you the fix.

Why I wrote this tool

In most of the companies I have worked with, nobody knew the site was not compliant. It was neither negligence nor cynicism: the subject is technical, it landed all at once on teams who had never been trained for it, and there was no simple way to check.

The arrival of the GDPR, then of Law 25 in Quebec, upended working methods that had been settled for years. Organisations did what was asked of them: they appointed a privacy officer, wrote a privacy policy, installed a cookie banner. On paper, the matter was closed.

Except the banner blocked nothing. It appeared, it offered Accept and Reject, and the trackers fired anyway, often before it had even finished rendering, and sometimes despite an explicit refusal. Nobody was lying: nobody had the means to see it. A badly configured consent tool looks exactly like a well configured one, as long as you do not watch what actually happens in the browser, second by second.

That is what I used to do by hand, and it was slow. Clear the browser, open the console, reload, watch for placements, look up what each cookie name stands for, do it all again after refusing to be sure. Half an hour per site, for a result I could only show a client as console screenshots, hardly the document that triggers a decision.

And once the facts were established, the most thankless part remained: writing the cookie section of the policy, cookie by cookie, purpose by purpose. That is why the tool writes it for you today.

I built Cookie Audit to run that check in a few minutes, and above all to produce a document someone who is not a technician can read. Because the real obstacle was never bad faith: it was that nobody in those organisations had any way to establish the problem, or to correct it.

It is free because a diagnostic tool that costs money will not be used by the people who need it most, the small outfits with neither a full time privacy officer nor a compliance budget. Establishing the facts should be available to everyone.

Why this check is worth running, with figures

Placing trackers before consent has been measured, and it is widespread. The study Automated Large-Scale Analysis of Cookie Notice Compliance, by Ahmed Bouhoula, Karel Kubicek, Amit Zac, Carlos Cotrini and David Basin of ETH Zurich, presented at USENIX Security 2024, analysed around 97,000 popular websites in the European Union.

Of the 48,843 sites carrying a cookie notice, 73.4% place trackers before any interaction. Of the 33,431 whose notice offers an accept button, 56.7% do not offer an equivalent reject button. And among the 16,231 sites that do offer a reject button, 65.4% likely collect data despite an explicit refusal.

That last figure is the one that justifies this tool. It does not describe careless sites that installed nothing: it describes sites that have a banner, a reject button, and where refusing changes nothing. From the outside, those sites look compliant. That is exactly what step 2 of the test measures.

France’s CNIL describes the same symptoms. During its formal notice campaign, it recorded three recurring failures: cookies placed automatically before any acceptance, banners that do not allow refusing as easily as accepting, and reject buttons followed by placement anyway. Around 90 organisations had been served notice as of 14 December 2021. Its September 2020 recommendation also holds that the site operator must be able to provide, at any time, proof that consent was validly collected.

My own market survey of 9 August 2026 lands in the same range: roughly 85% of the large European sites I examined show a gap on cookies alone, and fewer than half of the banners offer a refusal as accessible as acceptance.

How to use it

One. Install the extension and pin it next to the address bar.

Two. Open the site you want to audit, then click the icon. The Inventory tab immediately shows every cookie present, sorted by category. The likely legal framework is already suggested from the domain, so check it.

Three. Move to the Consent test tab and start the clean state audit. A screen explains exactly what is about to happen: deleting this site’s cookies, clearing its local storage, reloading the page. You have to confirm. Note that you will be signed out of this site if you were signed in, and that no other site is touched.

Four. Follow the three steps. The tool tells you when to click Reject all, then Accept all, and observes in between. You can close the extension window, recording continues. Scroll the whole page: some trackers, embedded videos for instance, only fire once visible.

Five. Move to the Policy tab to compare with what the site declares, then click Report. That is where the action plan and the policy text to copy live.

What I do not promise

This tool is not a compliance certificate. It shows what your site actually places, recalls the applicable rules and offers a policy text, which is the starting point of any compliance work, but it replaces neither legal advice nor a consent platform.

The generated policy text is a draft. It reflects what was observed during one audit, at one moment, and anything to complete is marked in brackets. Read it, complete it, and have it reviewed if the stakes justify it.

The report it produces is a technical document generated on your own machine. It is neither legal advice nor a bailiff’s report: the timestamp comes from your computer’s clock, and the SHA-256 fingerprint guarantees the integrity of the document, not the date it was produced.

An observation remains an observation. A cookie identified as advertising may have a justification the extension knows nothing about; an unknown cookie may be perfectly legitimate. That is why the verdict has four levels rather than two, and why nothing is ever called a breach.

Rules change. The reference texts built into the tool reflect the state of the law on the date shown in the report, not necessarily the day you read it.