I have a cookie banner. Does that mean I am fine?

Not on its own. What matters is what loads before somebody interacts with it. A banner that appears after the analytics and advertising tags have already run is not doing the job it looks like it is doing, and that is the most common fault we see on small business sites.

Do I need consent for Google Analytics now?

The Data (Use and Access) Act created an exemption for analytics used solely to measure your own site's performance, with conditions. Whether your configuration meets those conditions is a question about your setup, not something a scan can determine, so we will not answer it for you.

You found trackers I did not know about. How?

They are usually installed by something else. A chat widget, a booking system, a marketing plugin or an embedded video can each bring their own. That is exactly why the list is worth seeing: most owners have never been shown who is actually receiving their visitors' data.

Does this check every page?

No. It checks the page you give us, on one visit. Checkout, booking and account pages often behave differently, so if those matter to you they are worth checking separately.

Free tool

What does your site set before anyone clicks Accept?

We load your page as a brand new visitor who has accepted nothing, then list every cookie set and every third-party tracking script found. That is the moment the rules are about. Most site owners have never seen this list for their own site.

We read the page, its headers, its certificate and its public DNS records. We do not log in, we do not probe admin paths, and we identify ourselves in your server logs as OxwynXRay.

This tells you what happened, not whether you are compliant

We report what we observed on one page load: which cookies were set and which third-party scripts were present before any consent. We cannot tell you whether that is lawful for your business, and we will not say compliant or non-compliant, because the answer depends on what each cookie is for, whether it meets the strictly necessary test, and whether the analytics exemption applies to how you have configured it. None of that is visible from outside. Treat this as evidence to take to whoever manages your site, not as a verdict, and if the stakes are real then a data protection adviser is cheaper than getting it wrong.

Why the moment before Accept is the one that matters

Under PECR, cookies that are strictly necessary to deliver the service somebody asked for can be set without permission. Analytics and advertising cookies are not strictly necessary. So the question is never whether you have a banner, it is what already happened by the time the banner appeared. A banner over a page that has already set advertising cookies is decoration.

The DIY builder problem

Wix, Squarespace and most WordPress consent plugins ship a banner that looks right and loads the scripts anyway. The banner is a front end control, and the tags are often injected in the page head where the banner has no say. The result is a site whose owner reasonably believes they are covered, sitting on the exact fault the rules describe.

What changed in February 2026

The Data (Use and Access) Act amended the PECR cookie rules and created an exemption for analytics used solely to measure your own site's performance. It has conditions attached. It is not a general permission to load analytics without asking, and a lot of guidance written before February 2026 is now describing rules that have moved.

What this costs when it goes wrong

The maximum penalty for breaching the cookie and electronic marketing rules is now 17.5 million pounds or 4 per cent of global annual turnover, whichever is greater, raised from 500,000 pounds. In practice the ICO concentrates on large scale data misuse rather than small business banners. The realistic risk for a small firm is not a fine, it is a customer or a corporate client asking a question you cannot answer.

Questions

I have a cookie banner. Does that mean I am fine?: Not on its own. What matters is what loads before somebody interacts with it. A banner that appears after the analytics and advertising tags have already run is not doing the job it looks like it is doing, and that is the most common fault we see on small business sites.
Do I need consent for Google Analytics now?: The Data (Use and Access) Act created an exemption for analytics used solely to measure your own site's performance, with conditions. Whether your configuration meets those conditions is a question about your setup, not something a scan can determine, so we will not answer it for you.
You found trackers I did not know about. How?: They are usually installed by something else. A chat widget, a booking system, a marketing plugin or an embedded video can each bring their own. That is exactly why the list is worth seeing: most owners have never been shown who is actually receiving their visitors' data.
Does this check every page?: No. It checks the page you give us, on one visit. Checkout, booking and account pages often behave differently, so if those matter to you they are worth checking separately.

This tool is one part of the full X-Ray, which measures security headers, your certificate, speed, indexability and what your site publishes about itself. Same scan, same free report.