Recommended Free Tools
To audit third-party trackers, inspect what your pages actually request and store, then repeat the same journey before consent, after rejection, after acceptance, and after withdrawal. A cookie list alone is not enough: pixels, embedded resources, cross-site requests, and other ways of accessing information on a device can matter too. Treat the result as a technical inventory to investigate—not, by itself, a legal verdict.
What a tracker audit should cover
“How do I check what cookies my website sets?” is a useful starting question, but an audit should also look at requests to outside hosts, scripts, images and pixels, embedded content, and storage or access technologies that are not conventional cookies. Google describes third-party cookies by the cross-site context in which they are used; a cookie can be third-party in that context even if its domain belongs to the site owner but differs from the top-level page. See Google’s cookie-audit guidance.
As an Amazon Associate I earn from qualifying purchases.
For a UK-focused review, the ICO’s finalized guidance on storage and access technologies explains that PECR can cover any method of storing information on, or accessing information from, a user’s device. The browser view is still only part of the picture: it shows behavior observed in that browser session, not every server-side transfer or the legal status of a vendor.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prepare a clean, repeatable test
Choose representative pages and journeys before opening DevTools. Include pages with different templates and functions so that a landing page does not stand in for checkout, a logged-in area, or a form.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
- List important templates and journeys, such as landing pages, forms, logged-in areas, checkout, and pages with video, maps, or marketing tags.
- Use a fresh browser profile or clear relevant site storage before each run. A previous consent choice can otherwise alter what loads.
- Record the browser and version, date, page, locale, and consent state for every run.
- Repeat tests from the regions that matter to your audience. A single session does not establish what all visitors see.
Keep the test consistent: use the same page and interaction sequence for each consent state. This makes differences easier to attribute to the choice rather than to a different journey.
Inspect requests and cookies in Chrome
Chrome DevTools provides a practical manual starting point. Open DevTools on the page being tested and use the Network panel while reloading and interacting with the site. Review request hosts and the scripts, images, or other resources they load; inspect cookie information set or sent with requests. In the Application panel, open Storage > Cookies to see cookies associated with the site and embedded resources. Google describes these inspection options in its developer-tools documentation for cookies.
- Open DevTools: on the page, open Chrome DevTools and select Network. Reload the page with the panel open so the initial requests are captured.
- Review network activity: examine request hosts and resources, including scripts and image requests that may function as pixels. Check cookie information attached to requests and note relevant third-party hosts.
- Inspect stored cookies: select Application, then under Storage open Cookies. Review entries for the site and embedded resources.
- Check third-party-cookie behavior: use DevTools’ Privacy and security panel to examine third-party-cookie information and, where available, temporarily limit third-party cookies while DevTools is open. This is a diagnostic comparison, not a substitute for testing the site’s real consent choices.
For deeper browser-level event detail, Google documents recording a Chrome NetLog at chrome://net-export and inspecting cookie events such as COOKIE_STORE and URL_REQUEST in the Network Log Viewer. Google’s developer-tools documentation also describes PSAT, a Chrome extension that adds cookie-analysis information to DevTools. These are optional aids: they help analyze browser behavior but do not prove compliance.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Test every consent state separately
Seeing a banner is not evidence that optional tracking waits for a choice. Run the same page journey with no choice yet, after rejecting optional categories, after accepting, and after withdrawing or revising the choice. Save the requests and storage state for each run.
- No choice yet: identify scripts, pixels, requests, and storage that appear before the visitor acts.
- Reject optional categories: check whether the relevant optional activity is suppressed, rather than relying on the banner’s appearance or button label.
- Accept: record what begins only after the affirmative choice.
- Withdraw or revise: change the preference and check subsequent activity to see whether optional behavior changes.
Compare network activity as well as cookies. A request can transmit data without setting a cookie, so a cookie-only comparison can miss meaningful activity. Repeat each state from a clean start where necessary to avoid a prior choice carrying over.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Turn observations into an actionable inventory
Record what the browser showed without guessing what an unfamiliar name means. A useful inventory connects each observation to its page, scenario, and next action.
| Field | What to record |
|---|---|
| Host or provider | The observed request domain or apparent service provider; mark identity as unconfirmed if uncertain. |
| Resource or storage item | Request, script, image or pixel, cookie name, or other observed storage/access behavior. |
| Page and scenario | Page or journey, browser and version, date, locale, and consent state. |
| Timing | Whether it appeared before a choice, after rejection, after acceptance, or after withdrawal. |
| Apparent function | A tentative purpose based on the site and vendor documentation; do not treat a name alone as proof. |
| Owner and follow-up | The person responsible for checking the tag, vendor, configuration, disclosure, or consent behavior. |
Reconcile this technical inventory with the cookie notice and privacy information. Ask service providers to confirm the purpose and configuration of activity the trace cannot explain. Google specifically recommends checking with third-party providers about their plans for cross-site cookies and whether a library upgrade or configuration change is needed; see its audit guidance. Do not mark a cookie “strictly necessary” or a vendor “compliant” from a name or network trace alone.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Prioritize fixes and rerun the audit
Investigate unexpected activity before consent first. Then work through unexplained vendors, stale tags, missing disclosures, and activity that continues after rejection or withdrawal. Assign an owner to each issue, change the relevant tag or consent configuration, and repeat the same scenarios to verify the result. Rerun tests after changes to tags, the CMS, the consent banner, or vendors, and periodically as the site evolves.
What the audit can—and cannot—say about compliance
A technical observation is evidence about what happened in a particular browser session, not a complete legal conclusion. Rules and exceptions depend on jurisdiction, technology, and purpose. For UK sites, the ICO’s finalized guidance on storage and access technologies was updated on 29 April 2026. Its overview of cookies and similar technologies says PECR covers storing information on or accessing information from a user’s device by any method, and describes exceptions for transmission of a communication and technologies strictly necessary to provide a service the user requested. Helpful or convenient does not automatically mean strictly necessary.
The ICO says valid consent must be freely given, specific, informed, and indicated by an unambiguous positive action; simply continuing to use a site is not enough. Its overview says non-essential cookies should not be set on the homepage before consent. Where device data is personal data, UK GDPR obligations also apply; PECR consent and the lawful basis for later processing are related but distinct questions. These UK points should not be generalized to every visitor or jurisdiction. The applicable rules can depend on the visitor’s location, service, technology, and purpose.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
