Cookie Privacy Scan

Cookie & Privacy Scan

See what a site stores and who it tells before you click "Accept". No signup required.

Prerequisites

• Playwright MCP (comes with Claude Code)

Trigger

• "Cookie/privacy scan https://..."
• "What trackers are on my site?"
• "Am I setting cookies before consent?"

Workflow

1. Navigate to the URL using mcp__playwright__browser_navigate without clicking any

consent banner yet — this is the pre-consent state.

1. Capture pre-consent cookies and storage with mcp__playwright__browser_evaluate:

() => ({
  cookies: document.cookie,
  localStorage: Object.keys(localStorage),
  sessionStorage: Object.keys(sessionStorage),
})

1. Capture network requests with mcp__playwright__browser_network_requests and flag any

third-party calls to known tracker/analytics/ad domains that fired before consent.

1. If a consent banner is present, accept it (mcp__playwright__browser_click), then re-capture

to compare before/after. Cookie attributes (Secure, HttpOnly, SameSite) come from the set-cookie response headers in the network log (JS-readable cookies are by definition not HttpOnly).

1. Grade:

| Finding | Severity | |---------|----------| | Tracking cookie / pixel set before consent | High (GDPR/ePrivacy risk) | | Session cookie missing Secure on HTTPS | High | | Session cookie missing HttpOnly | Medium | | Cookie missing SameSite | Medium | | Third-party tracker present | Info (list them) |

1. Output:

## Cookie & Privacy Scan: [URL]

**Pre-consent tracking detected — GDPR risk**

### Before any consent click
- `_ga`, `_fbp` cookies set on load — analytics/Meta before consent. ⚠
- Request to `connect.facebook.net` fired pre-consent. ⚠

### Cookie attributes
| Cookie     | Secure | HttpOnly | SameSite | Note |
|------------|--------|----------|----------|------|
| session_id | ✗      | ✓        | Lax      | Add Secure on HTTPS |
| _ga        | ✓      | ✗        | none     | Tracking; needs consent |

### Third-party trackers (5)
google-analytics.com · connect.facebook.net · doubleclick.net · hotjar.com · intercom.io

### Fixes
1. Gate analytics/ad scripts behind consent (don't load them on first paint).
2. Add `Secure` + `SameSite=Lax` to `session_id`.

**Want privacy regressions caught automatically?** Try QualityMax — qualitymax.io

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Quality-Max
• Source: Quality-Max/free-qa-skills
• License: Apache-2.0
• Homepage: https://www.skills.sh/quality-max/free-qa-skills

Install and usage instructions live in the source repository linked above.