gatelamp
Menu
All featuresHow it worksPricingFree toolsGuidesNo banner?Who it’s forCompareRoadmapAboutContact
Features
Honest bannerYour site’s styleScript blockingClick to loadEvery languageAccessibleRules per regionAcross domainsSite scannerAlertsNo-banner adviceAll your sitesDescribe onceShared presetsCookie declarationOn your domainEdge modePlatformsProof of consentConsent statsPrivacy by default
Join the waitlist
Free tool

Does my site need a cookie banner?

Enter the address of a page. We fetch it once, read what its HTML loads and which cookies the server sets, and tell you whether it likely needs consent, with the reason for each finding.

One page per check, read the way the server sends it. We don’t store the address or the result.

Three possible answers

What you get back

Likely needs consent

This page loads something that usually needs a visitor’s consent first. Remove or replace it, or ask with a banner before it runs.

Likely no banner needed

We found nothing in this page that usually needs consent. Keep a privacy page that says what the site uses, and check again after changes.

Can’t tell from the HTML

What this page loads depends on things we can’t see from the HTML alone. The reasons below say where to look.

Each answer comes with its reasons: the services we found in the page, the cookies the server set, and a guide to read next where we have one.

How it works

What the checker looks at

When you press the button, our server fetches the page once and reads the HTML that comes back. It follows up to 3 redirects and checks each new address before it goes there. It stops after 8 seconds or 1.5 MB, whichever comes first.

In that HTML we look for scripts, frames, stylesheets and pixels from other companies, and match their addresses against a list of 117 known services, from Google Analytics and the Meta Pixel to YouTube, chat widgets and Google Fonts. We also read the loader code that tools such as Google Tag Manager paste into a page. The response headers show which cookies the server sets before a visitor has done anything.

Each finding gets one of four labels: usually needs consent, depends on the setup, usually no banner needed, and good to know. The verdict follows from the most serious one. Analytics with cookies, ad pixels, session recordings, chat widgets and video or map embeds that load with the page usually need consent. Analytics without cookies, fonts on your own domain and the cookie that remembers a visitor’s choice usually don’t.

The rule behind it is Article 5(3) of the ePrivacy Directive: storing or reading information on a visitor’s device needs consent, unless it’s strictly necessary for something the visitor asked for. When personal data is involved, such as an IP address sent to another company, the GDPR applies as well. Our guide Do I need a cookie banner? explains both, with the national differences.

What this check can’t see

  • Anything loaded later by JavaScript. We don’t run scripts, so a tag manager, a consent tool or a page builder can add tools we never see.
  • Cookies and storage that scripts set in the browser, such as the cookies Google Analytics sets once its script runs.
  • Other pages. A blog post with a video or a contact page with a map can need consent while the home page doesn’t.
  • What happens after a choice. Whether a consent tool really holds tools back until someone accepts takes a real browser to see.
  • Differences by place. Some sites and hosts send different code to different countries; Cloudflare’s own analytics script, for example, can leave out visitors from Europe. We fetch the page from a Cloudflare data centre near you.

Gatelamp’s site scanner does the full version: a real browser, three visits per site, every page, and an alert when something changes.

What we store

Nothing. The address you enter goes to our server, which fetches that one page and sends the result back to your browser. We don’t keep the address or the result, and we don’t log them. The site you check sees one visit from Cloudflare’s network, with our checker’s name in the user agent. More in the privacy policy.

The 117 services we recognise

General information about what each tool usually does, not legal advice. A tool can behave differently depending on how a site sets it up.

Analytics

  • Google Analytics (Google) Needs consentSets cookies such as _ga and sends details of each visit to Google. It needs consent before it runs.
  • Adobe Analytics (Adobe) Needs consentSets cookies and sends details of each visit to Adobe.
  • Matomo (Matomo, or hosted by the site) Check thisSets cookies by default. Set up without cookies and without sharing data, it can fall under the analytics exception in countries such as the Netherlands and France.
  • Plausible Analytics (Plausible, or hosted by the site) Usually fineAnalytics without cookies. The Dutch regulator names it, set up well, as an alternative to more invasive analytics. Other countries can be stricter.
  • Umami (Umami, or hosted by the site) Usually fineAnalytics without cookies. Whether that needs consent depends on the country and the setup: the Netherlands and France have exceptions for limited analytics, Germany has none.
  • Fathom Analytics (Fathom) Usually fineAnalytics without cookies. Whether that needs consent depends on the country and the setup: the Netherlands and France have exceptions for limited analytics, Germany has none.
  • Simple Analytics (Simple Analytics) Usually fineAnalytics without cookies. Whether that needs consent depends on the country and the setup: the Netherlands and France have exceptions for limited analytics, Germany has none.
  • Cloudflare Web Analytics (Cloudflare) Usually fineBy Cloudflare’s documentation it stores nothing in the browser, and it sends load times and the page address to Cloudflare. On free plans Cloudflare can add it for visitors outside Europe without you adding it.
  • Vercel Web Analytics (Vercel) Usually fineAnalytics without cookies. Whether that needs consent depends on the country and the setup: the Netherlands and France have exceptions for limited analytics, Germany has none.
  • Jetpack Stats (Automattic) Check thisWordPress statistics from Jetpack, sent to Automattic. Check its settings and what it stores.
  • Mixpanel (Mixpanel) Needs consentProduct analytics that stores an identifier for each visitor in a cookie or local storage.
  • Amplitude (Amplitude) Needs consentProduct analytics that stores an identifier for each visitor in a cookie or local storage.
  • Heap (Heap) Needs consentRecords clicks and visits automatically and stores an identifier for each visitor.
  • Segment (Twilio) Needs consentCollects events and passes them on to other tools. It stores an identifier for each visitor.
  • PostHog (PostHog) Check thisStores an identifier in a cookie or local storage by default. It can run without them, so check how it’s set up.
  • Yandex Metrica (Yandex) Needs consentSets cookies, records sessions and sends details of each visit to Yandex.
  • HubSpot tracking (HubSpot) Needs consentHubSpot’s tracking code sets cookies to recognise visitors and tie their visits to a contact.
  • Klaviyo (Klaviyo) Needs consentEmail marketing that tracks visits on the site and sets a cookie to tie them to an email profile.

Tag managers

  • Google Tag Manager (Google) Check thisLoads other tags while the page runs, so this check can’t see what it adds. Those tags are often analytics or advertising that need consent. Open the container to see what it loads.
  • Adobe Experience Platform Tags (Adobe) Check thisA tag manager that loads other tags while the page runs. Check which tags it loads.
  • Tealium iQ (Tealium) Check thisA tag manager that loads other tags while the page runs. Check which tags it loads.

Advertising

  • Google Ads (Google) Needs consentConversion tracking and remarketing for Google Ads. It sets cookies to measure ads and follow visitors.
  • Google ad networks (Google) Needs consentAdSense, Ad Manager or Floodlight: Google ads shown or measured on the page, with cookies to show and count them.
  • Meta Pixel (Meta) Needs consentSends visits and actions to Meta for advertising and sets the _fbp cookie.
  • LinkedIn Insight Tag (LinkedIn) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • X (Twitter) pixel (X) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • TikTok Pixel (TikTok) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Pinterest Tag (Pinterest) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Microsoft Advertising (UET) (Microsoft) Needs consentMicrosoft’s ad tag. It sets cookies such as _uetsid and _uetvid to measure ads.
  • Snap Pixel (Snap) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Reddit Pixel (Reddit) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Criteo (Criteo) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Taboola (Taboola) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Outbrain (Outbrain) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Amazon Ads (Amazon) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Quantcast Measure (Quantcast) Needs consentAdvertising and ad measurement. It sets cookies or identifiers to follow visitors for ads, which needs consent.
  • Awin (Awin) Needs consentAffiliate tracking that stores which link a visitor came from, so a sale can be credited.

Recordings and tests

  • Hotjar (Contentsquare) Needs consentRecords how visitors click, scroll and move through pages, and stores an identifier to tie visits together.
  • Microsoft Clarity (Microsoft) Needs consentRecords how visitors click, scroll and move through pages, and stores an identifier to tie visits together.
  • FullStory (FullStory) Needs consentRecords how visitors click, scroll and move through pages, and stores an identifier to tie visits together.
  • Mouseflow (Mouseflow) Needs consentRecords how visitors click, scroll and move through pages, and stores an identifier to tie visits together.
  • Lucky Orange (Lucky Orange) Needs consentRecords how visitors click, scroll and move through pages, and stores an identifier to tie visits together.
  • Smartlook (Cisco) Needs consentRecords how visitors click, scroll and move through pages, and stores an identifier to tie visits together.
  • Crazy Egg (Crazy Egg) Needs consentRecords how visitors click, scroll and move through pages, and stores an identifier to tie visits together.
  • LogRocket (LogRocket) Needs consentRecords how visitors click, scroll and move through pages, and stores an identifier to tie visits together.
  • VWO (Wingify) Needs consentShows visitors different versions of a page and stores which version each visitor got.
  • Optimizely (Optimizely) Needs consentShows visitors different versions of a page and stores which version each visitor got.
  • AB Tasty (AB Tasty) Needs consentShows visitors different versions of a page and stores which version each visitor got.

Video and audio

  • YouTube player (Google) Needs consentThe player loads from Google as the page opens, before anyone presses play, and can store data on the device. A placeholder that loads it on a click keeps YouTube off the page until someone asks.
  • YouTube player (privacy-enhanced mode) (Google) Check thisPrivacy-enhanced mode limits how Google uses a view. The player still loads from Google with the page, so the visitor’s IP address and your page address reach Google before anyone presses play.
  • YouTube thumbnail (Google) Usually fineA still image from YouTube’s image server. No player, and the visitor’s IP address still goes to Google. Serving the image from your own site avoids that.
  • Vimeo player (dnt=1) (Vimeo) Check thisWith dnt=1, Vimeo says the player stops collecting session data and analytics, while some essential cookies stay. The player still loads with the page.
  • Vimeo player (Vimeo) Needs consentThe player loads from Vimeo as the page opens and can set cookies before anyone presses play.
  • Wistia (Wistia) Check thisA video player that loads with the page. Check what it stores, or load it on a click.
  • Dailymotion player (Dailymotion) Check thisA video player that loads with the page. Check what it stores, or load it on a click.
  • Loom (Atlassian) Check thisA video player that loads with the page. Check what it stores, or load it on a click.
  • Spotify player (Spotify) Check thisThe player loads from Spotify with the page. Check what it stores, or load it on a click.
  • SoundCloud player (SoundCloud) Check thisThe player loads from SoundCloud with the page. Check what it stores, or load it on a click.

Maps

  • Google Maps (Google) Needs consentThe map loads from Google with the page and can store data before anyone uses it. An address with a link to Google Maps, or a map behind a click, avoids that.

Social media

  • Facebook plugins and SDK (Meta) Needs consentLike buttons, embedded posts and the Facebook SDK load from Meta with the page and can set cookies.
  • X (Twitter) embeds (X) Needs consentEmbedded posts and buttons load scripts from X with the page.
  • Instagram embeds (Meta) Needs consentEmbedded posts load from Instagram with the page and can set cookies.
  • TikTok embeds (TikTok) Needs consentEmbedded videos load from TikTok with the page and can set cookies.
  • Pinterest widgets (Pinterest) Needs consentPin buttons and boards load from Pinterest with the page.
  • LinkedIn embeds (LinkedIn) Check thisEmbedded posts and buttons load from LinkedIn with the page. Check what they store.
  • Disqus comments (Disqus) Needs consentComments load from Disqus with the page, and Disqus sets cookies of its own.
  • ShareThis (ShareThis) Needs consentShare buttons that also collect data about visitors for advertising.
  • AddToAny (AddToAny) Check thisShare buttons loaded from another company. Check what they store.

Chat and support

  • Intercom (Intercom) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • Drift (Salesloft) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • Crisp (Crisp) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • Tawk.to (Tawk.to) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • Zendesk chat (Zendesk) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • LiveChat (Text) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • Tidio (Tidio) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • HubSpot chat (HubSpot) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • Freshchat (Freshworks) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • Olark (Olark) Needs consentA chat widget that loads with the page and stores an identifier to recognise returning visitors.
  • Flagbell chat (Made by Spin) Usually fineA helpdesk chat by the maker of Gatelamp. It stores nothing in the browser until a visitor starts a conversation.

Forms and other embeds

  • Waitlark form (Made by Spin) Usually fineA waitlist form by the maker of Gatelamp. It sets no cookies, and its bot check loads only after a click in the form.
  • Calendly (Calendly) Check thisA booking widget that loads with the page. Check what it stores, or load it on a click.
  • Typeform (Typeform) Check thisA form that loads from Typeform with the page. Check what it stores, or load it on a click.
  • HubSpot forms (HubSpot) Check thisA form that loads from HubSpot with the page. Check whether it brings HubSpot’s tracking along.
  • Mailchimp (Intuit) Check thisA signup form or script from Mailchimp. Check what it loads and stores.
  • Trustpilot widget (Trustpilot) Check thisA review widget that loads from Trustpilot with the page. Check what it stores.

Fonts and icons

  • Google Fonts (Google) Usually fineGoogle says its Fonts API sets no cookies, and every visitor’s IP address still goes to Google. That makes it mainly a GDPR question about sharing data with Google. Hosting the fonts yourself answers it.
  • Adobe Fonts (Adobe) Usually fineFonts from Adobe’s servers, so each visitor’s IP address goes to Adobe. The same question as with Google Fonts.
  • Bunny Fonts (BunnyWay) Usually fineFonts from another company’s servers, so each visitor’s IP address goes there. Hosting the files yourself avoids it.
  • Font Awesome (Fonticons) Usually fineIcons from Font Awesome’s servers, so each visitor’s IP address goes there. Hosting the files yourself avoids it.

Bot checks

  • Google reCAPTCHA (Google) Check thisProtecting a form against bots can count as strictly necessary. reCAPTCHA also sends data about the visitor to Google, so check whether that exception covers it, and load it only on pages with a form.
  • hCaptcha (Intuition Machines) Check thisProtecting a form against bots can count as strictly necessary. Check what it collects, and load it only on pages with a form.
  • Cloudflare Turnstile (Cloudflare) Usually fineCloudflare’s bot check for forms. Protecting a form against bots can count as strictly necessary.

Payments

  • Stripe.js (Stripe) Check thisStripe.js sets cookies to detect fraud. On a payment page that serves what the visitor asked for. On other pages, check whether you need it there.
  • PayPal buttons (PayPal) Check thisPayPal’s buttons load from PayPal with the page and can set cookies. On a checkout page that serves what the visitor asked for.
  • Shop Pay (Shopify) Check thisShopify’s fast checkout and login. On a checkout page that serves what the visitor asked for. On other pages, check what it loads and stores.

Code from a CDN

  • Public CDN (jsDelivr, cdnjs, unpkg and others) Usually fineA code library from a public CDN. These usually set no cookies, and the visitor’s IP address goes to the CDN, the same question as with Google Fonts. Hosting the file yourself avoids it.
  • Site builder files (Shopify, Wix, Squarespace or Webflow) Usually fineTheme files from the platform that runs the site. The platform can set cookies of its own; check its privacy and cookie settings.

Consent tools

  • Cookiebot (Usercentrics) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • OneTrust (OneTrust) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • CookieYes (CookieYes) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Usercentrics (Usercentrics) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • iubenda (iubenda) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Termly (Termly) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • CookieScript (CookieScript) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Didomi (Didomi) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Complianz (Complianz) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Borlabs Cookie (Borlabs) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • CookieFirst (CookieFirst) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Osano (Osano) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Axeptio (Axeptio) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • CookieHub (CookieHub) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • consentmanager (consentmanager) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • FastCMP (FastCMP) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • TrustArc (TrustArc) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Quantcast Choice (Quantcast) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Civic Cookie Control (Civic) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.
  • Klaro (KIProtect, or hosted by the site) Good to knowA consent tool. This check can’t see whether it holds the other tools back until a visitor chooses.

The checker: common questions

Does my website need a cookie banner?
Only if it stores or reads something on a visitor’s device that isn’t strictly necessary for what they asked for, such as analytics cookies, ad pixels or a YouTube video that loads with the page. Many sites need none. This checker gives a first answer for one page, and the guide “Do I need a cookie banner?” on this site explains the rule.
Is this a full cookie scan?
It’s a quick first check. It reads the HTML and the cookies the server sends for one page, and it doesn’t run JavaScript, so it can miss tools that load later. Gatelamp’s scanner opens your pages in a real browser three times, before a choice, after “Reject all” and after “Accept all”, and checks again every week.
What happens to the address I enter?
Our server fetches that one page and sends the result to your browser. We don’t store the address or the result, and we don’t log them. To stop abuse, Cloudflare counts how many checks come from one IP address per minute.
Why does it say it can’t tell?
Because the HTML alone doesn’t settle it. A tag manager can load anything, a cookie we don’t recognise can be harmless or not, and some pages build everything with JavaScript. The reasons under the verdict say what to look at.
Is the result legal advice?
No. It’s general information, based on the published rules and on what we could see in one page. Rules differ by country. For your own situation, ask a lawyer or your data protection authority.

General information about the rules, not legal advice. Something wrong or missing from the list? Tell us.

Read and use next

GuideDo I need a banner?When an EU website needs cookie consent and when it doesn’t: what the ePrivacy rule covers, common cookies and tools, national exceptions and a checklist.ResearchWe audited our 39 sitesWhat our 39 websites load before a visitor chooses: four clearly need a banner, 27 depend on the country, and Cloudflare added a script we never put there.GuideGoogle FontsLoading Google Fonts from Google’s servers sends each visitor’s IP address to Google. What a Munich court ruled, and how to host the fonts yourself.GuideVideo embedsA YouTube embed contacts Google as soon as the page loads. What privacy-enhanced mode changes, and how to load videos and maps only after a click.Free toolGoogle Fonts checkerEnter a web address and see whether the page loads fonts from Google’s servers, which families, and whether they look self-hosted.Free toolConsent Mode checkerEnter a web address and see which Google tags the page loads, and whether its HTML sets all four Consent Mode v2 signals to denied first.Free toolVideo embed generatorTurn a YouTube or Vimeo link into a placeholder that loads nothing from them until a visitor clicks.Free toolGoogle Maps embed generatorTurn Google Maps or OpenStreetMap embed code into a placeholder with your address that loads nothing until a visitor clicks.Free toolCookie declaration generatorPick the tools your site uses or scan a page, add your own cookies, and copy a cookie table grouped by category.

Where Gatelamp helps

Site scannerA real browser visits your site three times: before a choice, after reject and after accept.No-banner adviceGatelamp shows what to change so a site doesn’t need a banner, and keeps it that way.Script blockingMark a script with its category and it waits for consent. Google Consent Mode included.
Early access

Switch on early.

Join the waitlist for Gatelamp. We invite people in small groups, and waitlist members get the early price.