Cookies and tracking are not the same
Why a domain that sets no cookies can still track visitors.
Script audit
See what loads before a choice.
The audit opens one page as a new visitor and records every request to another domain. Each domain is matched against more than 40 known services and sorted into a category.
It reports what it finds on that page. It is not a legal assessment.
Free, no account needed
Starting the scan
You can stay on this page. The results appear here when the scan finishes.
This is taking longer than usual. The scan is still running.
The scan didn't finish
Some websites block automated scanners with a firewall or bot protection.
What it checks
Every domain the page talks to.
The audit never answers the consent banner, so everything it records loaded before a visitor made a choice.
Third-party domains
Every domain other than the site's own that the page requests, from analytics tools to advertising pixels and embedded widgets.
Before a choice
Flags analytics and marketing services that load before the visitor could accept or reject cookies.
Cookies
Shows which third-party domains set cookies before any choice, and the names of those cookies.
Categories
Sorts each domain into analytics, marketing, functional, essential or unknown, using a list of more than 40 known services.
Requests
Counts the requests each domain makes while the page loads, so the busiest ones stand out.
Timing
Records how many milliseconds after the page started loading each domain made its first request.
How it works
A first visit, recorded.
The audit watches the network while the page loads, then sorts what it saw by domain.
-
Step 1: Enter a page address
No installation, account or code change. Most people start with their homepage. -
Step 2: The page loads as a new visitor
The audit records every network request to another domain, and when each one was made. -
Step 3: Read the breakdown
Each domain shows its category, its requests, its cookies and whether it loaded before a choice.
Reference
Common third-party services.
The services the audit finds most often, and whether they usually need consent before they load. Not every third-party domain tracks visitors: a content delivery network may only serve files.
| Service | Usual domain | Category | Consent before it loads |
|---|---|---|---|
| Google Analytics | google-analytics.com |
Analytics | Usually needed in the EU and the UK |
| Meta Pixel | connect.facebook.net |
Marketing | Usually needed in the EU and the UK |
| Google Ads | googleadservices.com, doubleclick.net |
Marketing | Usually needed in the EU and the UK |
| Microsoft Clarity | clarity.ms |
Analytics | Usually needed in the EU and the UK |
| Hotjar | static.hotjar.com |
Analytics | Usually needed in the EU and the UK |
| LinkedIn Insight Tag | snap.licdn.com |
Marketing | Usually needed in the EU and the UK |
| TikTok Pixel | analytics.tiktok.com |
Marketing | Usually needed in the EU and the UK |
| Chat widgets such as Intercom | widget.intercom.io |
Functional | Often needed, because they set cookies |
| Cloudflare CDN | cdnjs.cloudflare.com |
Content delivery | Usually not needed when it only serves files |
| jsDelivr | cdn.jsdelivr.net |
Content delivery | Usually not needed when it only serves files |
For a wider check of one page, including the consent banner and the privacy policy, run the GDPR compliance scanner.
Questions about the script audit
What is a third-party script?
JavaScript that a page loads from another domain, such as Google Analytics (google-analytics.com), Meta Pixel (connect.facebook.net) or a chat widget. These scripts can set cookies and collect data about visitors, so many of them need consent under privacy laws.
Why do third-party scripts matter under the GDPR?
Scripts that are not strictly necessary, such as analytics, advertising and social media tags, need the visitor's consent before they run or set cookies, under the ePrivacy rules and the GDPR's standard for consent. A script that loads before the visitor answers the consent banner runs without that consent.
What does "before a choice" mean?
The audit loads the page without touching any consent banner. Every script that runs in that state runs before the visitor could accept or reject cookies.
How do I hold scripts back until consent?
With a consent management platform. Kukie.io's banner holds back known trackers until the visitor accepts their category, and any other script you tag with its category waits too. You manage your scripts in Cookies & Scripts.
What are unknown third-party domains?
Domains that are not in the audit's list of known services. They can be harmless, such as your own content delivery network or hosting provider, or trackers the list does not know yet. Check each one: if it sets tracking cookies or collects personal data, it probably needs consent.
How often should I audit my scripts?
Whenever you add an integration, update a plugin or change a marketing tool, because third-party scripts can also start loading other scripts over time. On the Pro, Agency and Unlimited plans, Kukie.io can repeat its cookie scan every week or every month.
Learn more
Read up on third-party scripts.
What scripts do with visitors' data, and how consent categories work.
Common cookie consent mistakes
The script and consent mistakes scans find most often.
Understanding cookie categories
How the essential, functional, analytics and marketing categories work.
Hold back scripts until visitors choose.
Kukie.io's consent banner keeps known analytics and marketing scripts waiting until the visitor accepts their category.
Disclaimer
Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.
