Free tool

Cookie & Privacy Scanner

See which cookies and trackers your website sets, and whether you have the privacy basics the Data Protection Act expects.

Reads the homepage only, passively. A full review checks consent banners, retention and sub-pages.

What this checks

Loads your homepage the way a first time visitor would and lists the names of cookies the server sets in its response.
Scans the page source for well known tracking scripts: Google Analytics, Google Tag Manager, the Meta Pixel, Hotjar, LinkedIn Insight, the TikTok Pixel, Microsoft Clarity and HubSpot.
Looks for a privacy policy link or reference on the page.
Raises a concern when cookies or trackers are present but no privacy policy can be found.

Why it matters

Tracking scripts send information about your visitors to third parties, and people have a right to know that is happening. Zimbabwe's Cyber and Data Protection Act of 2021 expects organisations to be open about how personal information is collected and used. A clinic or school that runs advertising pixels on its site without a privacy notice is sharing visitor data it has not explained.

How to read the result

Cookies listed here are only those set by the server on the first response. Cookies that JavaScript sets after the page runs will not appear, so the real count can be higher.
A tracker in the list means its script is referenced in the page source. It does not tell you whether it loads before or after consent.
Session or security cookies from your platform are normal. Advertising and analytics trackers are the ones that need explaining to visitors.
The privacy check is a simple text match. Confirm the linked page actually describes the trackers you use.

How to fix what it finds

Remove tracking scripts you no longer use; old pixels from past campaigns are common and send data for no benefit.
Publish a privacy notice that names each analytics or advertising service, what it collects and why.
Load non essential trackers only after the visitor agrees, using a consent banner or your tag manager's consent settings.
Mark your own cookies Secure, HttpOnly where scripts do not need them, and SameSite=Lax or Strict.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

Do I need a cookie banner in Zimbabwe?

The Act focuses on transparency and lawful processing rather than prescribing a banner, but if you use advertising or analytics trackers you should tell visitors and give them a choice. A banner backed by a clear privacy notice is the common way to do that. Take legal advice for your specific case.

Why does the scanner show no cookies when my browser shows several?

Your browser also stores cookies created by JavaScript after the page loads, plus cookies from earlier visits. This tool only sees what the server sends on the first response.

Is Google Analytics personal data?

It collects identifiers such as cookie IDs and device details that can relate to an individual, so treat it as personal data. Mention it in your privacy notice and switch on IP anonymisation features where your setup supports them.