Cookie scanner and declaration
The cookie scanner visits your site in a real Chrome browser and records what each page stores and loads. The results show what the banner needs to block and keep your cookie declaration current.
What a scan does
Starting from the home page of the site's main domain (the shortest registered hostname, verified where the plan requires it), the scanner follows links on the same site, up to 15 pages. It visits each page three times:
| Pass | What it finds |
|---|---|
| Before consent | Cookies, local and session storage, IndexedDB, and third-party requests made before any choice. Under opt-in, anything here that is not necessary is a problem. A request that only downloaded a script the banner then held back from running is shown as held back, not as tracking. |
| After accepting | Everything the site uses once the visitor allows all categories. This is what goes in the declaration. |
| After rejecting | What is still stored or loaded when the visitor chooses "Only necessary". |
Each pass also checks the banner. It checks that the banner shows, that the script loads from the CDN and serves the latest published version, and that the first layer has a reject button.
Scanning a website before it is set up
Under Website scans in the dashboard you can scan any public website, for example a site you are about to move to PXL Consent. The scan loads up to five pages without a choice, after accepting and after rejecting. It recognises common consent tools such as Cookiebot, OneTrust, CookieYes, Usercentrics, Didomi and Cookie Information, and clicks their own accept and reject buttons.
The report opens from a secret link that anyone with the link can read, so you can send it on. Links stop working after 30 days. Set up as site creates a site with the website's domains.
Classification
Findings are matched against a curated list of known cookies and services, which assigns each one a category, provider, purpose and retention. Anything unknown is marked not classified. PXL reviews unknown cookies from all sites and adds them to the list, and the next report shows the result.
Sites that may not need a banner
When a scan finds nothing that needs consent — no cookies or storage beyond the necessary ones, and no advertising, analytics or tag manager — the site page says so, and scan.no_consent_needed goes to your notification channels. We tell you; we never take the banner off by ourselves. A scan sees the pages it can reach: not pages behind a login, not tags that only fire after a click, and not what someone published after the scan ran. Talk to us before removing the banner from a site.
Scheduled scans and monitoring
Set a scan interval on the site (for example every 7 or 30 days) and scans run on their own. On plans with monitoring, every scan and the site's consent figures are checked, and problems open an incident that is emailed to the organisation's owners and admins: a missing banner, trackers before consent, storage that ignores a rejection, a missing reject button, an outdated banner copy, a sudden jump in the share of visitors accepting everything, or choices made faster than anyone could read the banner. An incident closes itself when a later scan no longer finds the problem.
The cookie declaration
Put the declaration on your privacy or cookie page. It lists every category with its cookies, provider, purpose and retention from the latest scan, updates itself after each scan, and follows the page language.
<div data-ccs-declaration></div>
<script src="https://cdn.consent.pxl.as/d/SITE-ID.js" async></script>It renders plain HTML tables that your site's CSS styles. For your own rendering, fetch https://cdn.consent.pxl.as/d/SITE-ID.json (add ?lang=en for another language).
On WordPress, the plugin's [pxl_cookie_declaration] shortcode shows the same table.
Scanner traffic
The scanner identifies itself with PXLConsentScanner/1.0 in its user agent, and only visits public addresses. See the scanner information page.