GDPR Scanner vs.
The Privacy Industry

What this comparison measures

Every row in the table is a scan of that company's own public website, run with the same scanner we use for every other site on the internet. The scanner visits the page like a first-time visitor, does not touch the cookie banner, and records every network request, cookie and tracking script that fires before anyone has consented to anything. The score and violation count come from that recording, and the PDF report next to each row is the evidence: the full list of what loaded, when, and where the data went.

This is a measurement, not an opinion. The scans were performed on 23 January 2026 and the results describe those websites on that date. Any of these companies can fix their configuration and re-scan; the table would then show the new result.

GDPR Scanner vs Cookiebot, OneTrust and other CMPs

A fair question: is GDPR Scanner a competitor to Cookiebot, OneTrust, Usercentrics or Complianz? Not in function. Those products are consent management platforms. You install one on your website, and it shows the banner, records consent choices and (when configured correctly) blocks tracking scripts until a visitor agrees. GDPR Scanner sits on the other side of the fence: it is the measurement. It does not manage consent on your site. It checks, from the outside, whether the consent setup you have actually works.

That is exactly why this table exists. A CMP is a tool, and like any tool it can be installed well or badly. The most common failure we measure across the web is a site with a professional consent banner and a tag setup that fires analytics and advertising scripts before the banner is answered. The banner asks the question; the site has already acted on the answer. No CMP can prevent that on its own, because the problem lives in how the site's tags are configured around it.

So the honest positioning is: if you need a consent banner, you may well end up using one of the products in this table. And whichever one you choose, you should verify the result with an outside measurement, because the vendor's dashboard reports its own configuration, not the finished behaviour of your pages.

Why do compliance vendors fail their own test?

Not malice, and probably not ignorance either. The pattern in the reports is the same one we see on ordinary business sites: a marketing team runs Google Tag Manager, advertising pixels and third-party fonts on the marketing website, and those tags were configured before, or outside, the company's own consent tool. Nine of the nine CMP websites we scanned loaded trackers or set cookies before consent. OneTrust, the market leader, scored 69/100. Osano advertises a "No Fines Guarantee" while its site fired Google Ads requests pre-consent.

The lesson is not "these companies are bad at their jobs". It is that compliance is a property of a configuration, not of a purchase. If the people who build consent tools for a living ship pre-consent tracking on their own sites, it is worth checking yours.

How to use these results

• Scan your own site first. It is free and takes about thirty seconds, and it tells you whether you have the same problem these vendors have.
• If you already run a CMP, read our cookie banner requirements guide to see the four ways banners fail in practice and how to check each one.
• If you are fixing a small-business site end to end, the GDPR checklist for small business websites covers the website behaviour and the paperwork behind it.
• To understand exactly what the scanner records and how the score is built, see how it works.

These results are factual measurements of public websites and general information, not legal advice or a verdict on any company's overall compliance.