Your cookie banner might be quietly illegal. Let's find out.
FixMyCookies inspects any website and tells you — in language a human can read — which consent problems it actually finds: trackers firing before anyone said yes, missing “Reject all”, cookies that outlive their welcome.
- No account needed
- Findings, not vague scores
- We never say “you're compliant”
Check a website
Yours, or a competitor's. Public pages only — we don't log in anywhere.
Not legal advice, and no automated scan is a legal opinion. We show you what we observed; a qualified professional decides what it means for you. See our commitments.
What a scan actually looks for
These are the failure modes that show up again and again on real sites. Every finding comes with the evidence we saw, so you can check our work.
Cookies set too early
Non-essential cookies or local storage written to your visitor's device before they made a choice — the single most common consent breach.
Trackers you forgot about
Analytics, pixels and embeds injected by plugins, themes or a marketing tag. Each one is a third party receiving visitor data.
Consent you can't refuse
A banner with “Accept” but no equally easy “Reject all”. Consent is not valid unless refusing is genuinely as simple as agreeing.
Cookies that won't expire
Session analytics quietly set for two years. Storage duration should be justified, not accidental.
Missing or vague policy
No cookie policy, no link from the banner, or a policy that lists “cookies” generically without naming the actual ones in use.
Consent that doesn't stick
A choice that is re-asked every visit, or silently ignored — both evidence that consent isn't being recorded or honoured.
Scan, fix, keep watch
Find out where you stand, close the gaps, then stop worrying about drift.
Scan
Enter a URL. We load the page like a first-time visitor and record which cookies and requests happen before any consent is given — then write it up in plain English.
Fix
A consent banner with real category controls, blocking of non-essential scripts until consent, and a record of what each visitor chose.
Monitor
Scheduled re-scans so a plugin update or a new marketing tag can't silently reintroduce the problem you just fixed.
What a report looks like
Concrete findings with the evidence attached — not a score out of 100.
Cookie & consent observations
Sample output · not a real scan result
- High Analytics requested before any consent choice Observed: a request to a third-party analytics endpoint fired on first paint, before the banner was interacted with. Under GDPR, non-essential storage needs consent first.
- High Advertising pixel set on page load Observed: a marketing pixel wrote a persistent identifier with no prior choice recorded.
- High No “Reject all” control in the banner Observed: the banner offered Accept, and a settings link. Refusing was materially harder than agreeing, which undermines the validity of the consent.
- Medium Cookie policy doesn't name the cookies in use Observed: a policy page exists but describes cookies generically rather than listing purposes and durations.
- Medium Long-lived session cookie Observed: a cookie presented as session-scoped carried an expiry well beyond the visit.
- Pass Valid TLS certificate Observed: HTTPS served correctly with a currently valid certificate.
Observations describe technical behaviour only. They are not a legal assessment and do not establish compliance or non-compliance.
Where this fits
There is no free lunch here, and we won't pretend otherwise.
| Approach | Cost | Tell you what's wrong | Continuous monitoring | Legal judgement |
|---|---|---|---|---|
| Do nothing | Free | No | No | Luck |
| A free consent plugin | Free | Rarely — it assumes you configured it right | No | No |
| FixMyCookies | See pricing | Yes — with the evidence | Planned: scheduled re-scans | No — never |
| Enterprise consent platform | Often four figures a year and up | Configuration, not diagnosis | Usually | No — add outside counsel |
| A privacy lawyer | Hourly | Yes | Not between engagements | Yes — this is the point |
Competitor descriptions are general characteristics of each category, not claims about any named product. We are not a substitute for legal advice, and the row above saying so is not modesty — it is the accurate position.
Pricing
Planned launch pricing, shown openly before launch. If it changes, it changes here first — nobody gets a surprise invoice.
Free
For finding out where you actually stand.
- One site scanned on demand
- Full findings list, evidence included
- Plain-English explanations
- No account, no card
Essential
For one site you need to keep clean.
- One website
- Consent banner with real category controls
- Scripts blocked until consent is given
- Consent records, so you can show what was agreed
- Scheduled re-scans and change alerts
- Email support
Agency
For people who manage other people's sites.
- Up to 10 client websites
- White-label reporting for clients
- Bulk installation across sites
- Priority support
The banner and monitoring tiers are not shipped yet. We would rather tell you that on the page than take a subscription for something you can't use. Prices are excluding VAT where applicable.
Things we will not do
A compliance product that lies to you about compliance is worse than useless. So, in writing:
We will never tell you that you are compliant
No scan, automated or otherwise, can establish that. We report what we observed and stop there. If you ever see the phrase “you're now compliant” on this site, it will be because we made a mistake worth apologising for.
We will never invent a statistic
No invented percentages about how many cookie banners fail. No made-up “average fine” figure. No customer counts we cannot evidence. Where a number appears on this site, it will be one you can check against its source.
We will never fabricate a testimonial
This section currently has none, because there are no customers yet. When real people say real things, they will appear here with permission and their actual words.
We will show our working
Each finding cites what we actually saw. If we're wrong, you'll be able to tell — and tell us, using the address in the footer.
We will not use fear as the sales pitch
Fines are real and the maximum is genuinely severe — up to €20 million or 4% of total worldwide annual turnover, whichever is higher, under Article 83(5) GDPR. But that is the ceiling, not the expectation, and we won't blur the two to frighten you into a subscription.
Questions worth asking
Isn't a free cookie plugin enough?
Sometimes, if it's configured correctly and actually blocks scripts before consent — which is the part most installations get wrong. A plugin that renders a banner but lets analytics fire regardless has given you a false sense of security rather than protection.
That's precisely why we scan instead of assuming: the only way to know is to look at what your site does before anyone clicks anything.
I don't have EU visitors. Does this apply to me?
If you have EU or UK visitors, GDPR or UK GDPR applies — where your business is based doesn't change that.
Other regimes are different in kind, not just in name. California's CCPA/CPRA is principally an opt-out and disclosure regime rather than a prior-consent one, so a cookie banner built for GDPR may be the wrong shape for it. Brazil's LGPD and Canada's PIPEDA each have their own mechanics. We'll say what we look for and which rule it relates to; we won't tell you it generalises.
What exactly do you do with a URL I submit?
We request the page as an ordinary visitor would, record which cookies and third-party requests occur and in what order, and turn that into the findings you see. We don't log into anything, we don't crawl behind a login, and we don't need access to your admin.
Only scan sites you're responsible for or that are publicly accessible and you have a legitimate reason to check. The full detail belongs in the privacy notice, which will be published at launch.
Is this legal advice?
No, and it isn't a substitute for it. We are a technical tool that describes observed behaviour. Whether a given observation creates legal exposure depends on facts we cannot see — your lawful basis, your contracts, your data flows, your supervisory authority's current posture.
We think a tool that's honest about that boundary is more useful than one that isn't.
Can I cancel? Is there a contract?
Monthly plans, cancel any time, no lock-in. We are not going to claim a retention rate we haven't measured.
When does this actually launch?
The scanner is in private beta now. Banner installation and scheduled monitoring are in development. Join the early-access list and you'll get a real email the day you can use each one — not a drip campaign.
Find out where your site actually stands
Enter a URL and get a straight answer about what your pages do — before a regulator, a customer, or a journalist asks the question for you.
- No account
- No card
- No spam
- Unsubscribe in one click