The free website privacy scanner that clicks Reject
Most scanners only watch what loads. Ours clicks Reject and watches again, detects the AI running on your site, and flags any API key leaking to the browser. About 30 seconds. No account.
Most scanners only watch. That's half the test.
A watch-only scanner loads your page and lists what fires before anyone touches the banner. Useful — but a banner can look perfect and still let every tracker through the moment a visitor clicks Reject. The only way to know is to make the choice and watch what happens next. So that's what our deep scan does.
Load & watch
Opens your site in a real, rendered browser and records every tracker, pixel, and request that fires before any choice.
Click Reject
Finds the Reject control the way a visitor would — vendor button, "manage → reject," or plain text match — and clicks it.
Watch again
Opens a second window and records what still fires after Reject. This is the part watch-only scanners skip.
Find AI & keys
Detects AI chat, browser-to-model API calls, and any exposed API key — then assembles one honest report.
Quick scan vs deep scan: a quick look shows what fires before any choice. The deep scan is the one that clicks Reject, watches again, and observes AI — the part that separates a real test from a snapshot.
Three honest verdicts — no jargon
After the scan clicks Reject and watches the second window, it tells you plainly which of these is true for your site.
Trackers fired anyway after the visitor clicked Reject — the banner shows a choice it doesn't honor. The scan names each one and how many.
Trackers held before any choice, and nothing non-essential fired after Reject. The banner is doing its job — holding until the visitor decides, standing down when they decline.
Google tags that load after Reject but signal to Google that consent was denied aren't counted against you — that's Consent Mode working as designed, and we say so.
It finds the Reject button the way a person would — the vendor's own control on Cookiebot, OneTrust, CookieYes, TrustArc and others; a second-layer "manage → reject" when that's the only route; ConsentPixel's own banner; or a plain button-text match. A banner you haven't tested this way is a banner you're hoping works — and it's the same check a plaintiff-side scanner runs.
It finds the AI running on your site
AI arrives on most sites bundled inside a widget or plugin nobody consciously added. The deep scan recognizes it and reports it plainly — AI chat assistants, direct browser-to-model API calls, and visitor-scoring vendors.
For each one it answers the three questions that matter: did it fire before the visitor chose? did it fire after Reject? can a consent tool hold it? — and labels its confidence honestly, so a first-party call that only looks like AI is marked "possible" and never counted as a finding.
It flags API keys leaking to the browser
This one isn't really privacy — it's security and money. If your page ships a key-shaped secret to a model API straight from the browser, anyone can read it: it's sent to every visitor's device in plain view, and a leaked model-API key can be scraped and used to run up charges on your account.
That's why we put it at the very top of your results, before any privacy finding. We never store the key and never show it back to you — we only tell you one is exposed and where. This alone is a reason to scan, even if you're confident about consent.
An OpenAI-shaped secret is shipped to the browser on /checkout. Anyone loading the page can read it.
The key itself is never stored or displayed by the scan.
See what your banner actually does
Run the deep scan: what fires before consent, whether your banner survives a Reject click, what AI is running, and whether a key is leaking — in about 30 seconds.
Run the free scan →One report that reads like a report
Not a wall of raw network logs — green, amber, and red bands, with any exposed key sitting above everything. The copy knows whether you're on Shopify, WordPress, WooCommerce, Wix, or Squarespace, and every finding expands to show exactly what fired before consent and after Reject.
And if your site comes back clean, we say so — and suggest keeping an eye on it, because sites change. No manufactured urgency, no damages figures waved at you.
We scan ourselves, too. consentpixel.com runs through the same engine — and when it once produced a false positive on our own install snippet, we fixed that before shipping. A scanner is only worth trusting if it's honest about its own limits.
Illustrative report — your results reflect your live site.
🇪🇺 Article 50 disclosure check (EU scans)
For scans run from the EU, the deep scan checks whether an AI chat launcher has a visible "you're talking to an AI" disclosure next to it: disclosed, missing, or not verifiable (inside a cross-origin frame it can't see into). It's framed as help for you as the deployer — a prompt to check, never a compliance verdict. What Article 50 requires →
Useful to four people, for four reasons
The same 30-second scan answers a different question depending on who's running it.
Site owners & founders
Know your real exposure in about 30 seconds — no account, no jargon. You'll see what fires before consent, whether your banner survives a Reject click, and whether any API key is leaking from your own store or app. For a lot of owners, the key check alone pays for the minute it takes.
DPOs & privacy leads
Evidence, not assumptions: what loads pre-consent, what persists after rejection, an inventory of the AI surfaces on your site, and — for EU scans — whether AI chat carries a visible disclosure. The raw material for a data-flow record or a vendor conversation, captured the way a browser really sees it.
Agencies
Walk into a client meeting with a scan showing their actual gaps — pre-consent firing, an ignored Reject, an AI widget nobody disclosed. The most concrete way to open a compliance conversation across a portfolio. We built a whole white-label setup for agencies around this motion.
Legal & privacy professionals
See what a plaintiff-style scan sees. Pre-consent firing of session-recording and ad-tracking tools is the exact pattern behind the current wave of California wiretapping claims — surfaced with expandable evidence and honest confidence tiers. A factual starting point. (Information, not legal advice.)
How it works — and what stays private
It opens your page in a real, rendered browser (not a static crawl), records the pre-consent window, clicks Reject, records a second window, checks for AI and leaked keys, and builds the report. About 30 seconds, start to finish.
No account to scan. Enter a public URL and go — no signup, no card, no obligation.
Your key is never stored or shown. If a key is exposed, the report only says one is — never reveals it.
Nothing is changed on your site. It loads your public page like any visitor's browser — no install, no access to your code.
Honest about limits. It can't see inside a vendor's cross-origin frame or onto your server, so some AI checks return "not verifiable" rather than guessing.
The free deep scan checks the URL you give it. For ongoing, multi-page coverage and automatic re-scans, that's what the paid monitoring in ConsentPixel adds — the free scan is the honest first look.
Free scanner FAQ
Is the website privacy scanner really free?
Yes — the scan is completely free and requires no account. Enter any public URL and the deep scan opens your site in a real browser, records what fires before consent, clicks Reject and watches again, checks for AI surfaces and exposed API keys, and gives you a full report in about 30 seconds. There's no signup, no credit card, and no obligation. Ongoing multi-page monitoring and automatic re-scans are part of the paid ConsentPixel product, but the one-time deep scan of your page is free.
What makes this different from other free privacy scanners?
Most free scanners only watch what loads before you touch the banner and then stop. This one goes three steps further: it clicks Reject and watches whether trackers fire anyway, so it tells you if your banner actually works, not just that it exists; it detects AI on your site — chat assistants, direct browser-to-model API calls, and visitor-scoring vendors — with honest confidence tiers; and it flags any API key leaking to the browser, shown above every privacy finding. It runs in a real rendered browser, not a static crawl.
What does "ignores rejection" mean in my results?
It means that after the scan clicked Reject on your consent banner, one or more trackers fired anyway. That's the most important finding the scan produces, because it shows the banner is offering a choice it doesn't honor — visitors who decline are still being tracked. The report names each tracker that fired after Reject and how many. The opposite verdict, "respects rejection," means non-essential trackers held before any choice and nothing fired after Reject. Google tags that load after Reject but signal that consent was denied are not counted against you — that's Google Consent Mode working correctly.
Can the scanner detect AI on my website?
Yes. The deep scan recognizes AI chat assistants (such as Intercom Fin, Drift, Crisp, Ada, Tidio, Zendesk AI, LivePerson, and Forethought), direct calls from the browser to model APIs (OpenAI, Anthropic, Google, Azure OpenAI, Bedrock, Cohere, Mistral, Hugging Face, Perplexity, Groq, Replicate, Together), and visitor-scoring vendors. For each, it reports whether it fired before the visitor chose, whether it fired after Reject, and whether a consent tool can hold it. Findings are labeled confirmed, likely, or possible — and a first-party call that only looks like an AI request is marked possible and never counted as a finding.
Is my API key safe if the scan finds one exposed?
Yes. If the scan detects that your page ships a key-shaped secret to a model API from the browser, it flags that at the very top of your results — but it never stores the key and never shows it back to you. It only tells you that a key is exposed and where the risk is. An exposed key matters because anything shipped to the browser can be read by anyone, and a leaked model-API key can be used to run up charges on your account. The fix is to move the call behind a server-side proxy so the key stays on your server.
Does a clean scan mean my site is compliant?
No — and we won't tell you it does. A clean scan means the scanner didn't observe non-essential trackers firing before consent or after Reject, didn't find an exposed key, and flagged any AI surfaces it could see. That's a good signal, but compliance depends on your full setup, your jurisdictions, and facts a browser scan can't observe (like server-side processing or what's inside a vendor's frame). The scan is a factual first look, not a legal verdict. This is general information, not legal advice — consult a qualified privacy professional for your situation.
Will scanning my own site cause any problems?
No. The scan loads your public page the same way any visitor's browser would — it doesn't change anything on your site, install anything, or require access to your accounts or code. It simply observes what executes and reports it. You can run it as often as you like. We also run the same engine against our own site, consentpixel.com, and hold it to the same honesty standard we offer you.
Scan your website free
What fires before consent · whether your banner survives Reject · what AI is running · whether a key is leaking. About 30 seconds, no account, report free to keep.
Run the free scan →Related reading
Information, not legal advice. The ConsentPixel free website privacy scanner is a diagnostic tool that reports what it can observe from a browser session. Its results are for general educational purposes, do not constitute legal advice, and are not a certification of compliance with any law. A scan cannot observe everything relevant to your obligations (for example, server-side processing or content inside cross-origin frames), and privacy law in this area is developing. Any statutory damages figure referenced elsewhere on our site — such as $5,000 per violation under California Penal Code §637.2 — is informational only. Consult a qualified privacy professional for advice on your specific situation. ConsentPixel — Privacy · Verified is not a law firm.