How a scan works

A scan starts when you submit a URL on the scan page. Your browser hands the URL to our scanning service and sends you straight to the report at /r/<id>. That page updates itself every ten seconds while the scan runs, and the link keeps working after you close the tab. A scan takes about two minutes.

The scan itself is performed by a real Chromium browser, not a fetch of the HTML. Scripts execute, cookies are set, third parties are called, and the consent banner renders exactly as it would for a first-time visitor. The browser then goes through four phases, named below as they appear in the raw evidence (phase 0, 2, 3 and 4).

Phase 0: pre-consent

The page is loaded and left alone. Nothing is clicked. This is the state a visitor sees before they have expressed any choice, and it is where the ePrivacy Directive Art. 5(3) question is answered: what was stored or read on the visitor's device before consent?

In this phase the browser records every cookie set, every network request with its domain and whether it is third-party, every script loaded, any request routed through a CNAME-cloaked subdomain, and any calls to browser APIs commonly used for fingerprinting. It also takes a desktop and a mobile screenshot of the page in this state, which appear on the report.

Reject (phase 2)

The browser locates the consent banner and takes the reject path. It then records the same set of observations again. The point is to check whether rejecting is as easy as accepting (GDPR Art. 7(3)) and whether the rejection is actually honoured: do the trackers stop, or do they keep firing?

Accept (phase 3)

The browser then takes the accept path. This establishes what the site does once consent has been given, and lets the reject and accept results be compared against each other.

Global Privacy Control (phase 4)

A final pass sends the Sec-GPC: 1 request header and sets navigator.globalPrivacyControl in the browser. The scan records whether the site treated that signal as an opt-out.

What else is recorded

Alongside the four phases, the scan notes:

• Whether a consent management platform is present and, where it can be identified, the vendor (for example CookieYes).
• Whether a banner is present, whether any choices are pre-ticked, and the banner's geometry, including how much of the viewport it covers.
• Whether the reject and accept choices were effective, and whether GPC was respected.
• The URL of the site's privacy policy, if one can be found.
• The site's technology (for example WordPress on Apache) and its DNS provider.

Third-party requests are classified using a tracker blocklist. The blocklist version is printed on the report alongside the rules version, for example trackerradar-2026.05.01.

From observation to findings

Once the four phases are captured, the observations are evaluated against the rule set. Each rule produces one finding with a status, a severity, a legal citation, a remediation note and the raw evidence it relied on. What we check lists the categories those findings fall into, and Reading your report explains how they are presented.

Automated compliance indicators, not legal advice.