You cannot inform users about cookies if you do not know what cookies your website uses. Yet a surprisingly large number of businesses deploy cookie banners without ever conducting a thorough cookies audit: listing cookie categories that are incomplete, outdated or simply wrong. A comprehensive cookies audit is the indispensable first step towards genuine GDPR compliance, and it is far more involved than simply opening your browser's developer tools. This guide walks you through every step of the process, from manual inspection to automated scanning, and explains how to maintain compliance as your website evolves.

Why do you need a cookies audit?

The GDPR and the ePrivacy Directive require you to provide users with specific, accurate information about the cookies your website uses. Article 13 of the GDPR mandates that you disclose the purposes of processing and the recipients of personal data. The ePrivacy Directive (Article 5(3)) requires prior informed consent before setting non-essential cookies: and "informed" means the user must know exactly what they are consenting to.

Specifically, you must be able to tell users:

  • What cookies your website sets and their names
  • What each cookie is used for (its purpose)
  • How long each cookie persists (its expiry)
  • Who sets each cookie (first-party or third-party, and which third party)
  • What category each cookie belongs to (necessary, analytics, marketing, functional)

Without a systematic audit, you simply do not have this information: and your cookie banner and privacy policy are, at best, incomplete guesswork. In the event of a complaint or regulatory inspection, the inability to demonstrate that your cookie declarations match reality is itself a compliance failure.

Enforcement authorities have specifically targeted inaccurate cookie declarations. The French CNIL, in its 2022 actions against Microsoft (EUR 60 million fine), cited the inadequacy of information provided about the cookies used on bing.com. The Italian Garante has similarly penalised websites where the declared cookie list did not match the cookies actually set.

When should you conduct a cookies audit?

A cookies audit is not a one-time event. You should conduct or refresh your audit:

  • Before launching a cookie banner: You need an accurate baseline to configure your consent management platform correctly.
  • After adding new third-party services: Every new analytics tool, chatbot, payment processor, social media widget, A/B testing platform or advertising pixel potentially introduces new cookies.
  • After website redesigns or platform migrations: Changing your CMS, theme or hosting environment can alter which cookies are set and when.
  • On a regular schedule: Best practice is to re-audit at least quarterly. Third-party scripts can update their cookie behaviour without notifying you. A cookie that was classified as "analytics" six months ago may now include cross-site tracking capabilities.
  • After a data protection complaint or inquiry: If a user or DPA questions your cookie practices, an up-to-date audit provides the evidence you need to respond.

How to carry out a manual cookies audit

Step 1: Prepare a clean environment

Open your browser in a private/incognito window with no extensions installed. Extensions: particularly ad blockers, privacy tools and development extensions: can alter cookie behaviour and give you a false picture. Clear all existing cookies and site data before you begin.

Use Google Chrome for the primary audit, as its DevTools provide the most comprehensive cookie inspection capabilities. You should also test in Firefox and Safari, since browser-specific behaviours (particularly around third-party cookie blocking) can result in different cookie profiles.

Step 2: Visit your website as a new user: without consenting

Navigate to your homepage without interacting with the cookie banner. Open Chrome DevTools (F12) and go to the Application tab, then Cookies in the left sidebar. Document every cookie that is present before you give any consent. These should only be strictly necessary cookies. If you see analytics or marketing cookies at this stage, you have a compliance problem: non-essential cookies are being set without consent.

This step alone reveals one of the most common violations: scripts that fire before the consent banner is interacted with. Google Analytics, Facebook Pixel, Hotjar and many other tools are frequently misconfigured to load on page load rather than after consent.

Step 3: Navigate the entire website

Visit every distinct page type on your site: homepage, product pages, category pages, blog posts, contact forms, checkout flow, account pages, search results. Different pages often load different scripts. A chatbot widget might only appear on the support page. A payment processor cookie might only be set during checkout. A video embed cookie might only appear on blog posts with embedded YouTube or Vimeo content.

After visiting each page type, return to the DevTools Application tab and record any new cookies that have appeared. Note which page triggered each new cookie.

Step 4: Consent and re-inspect

Now interact with your cookie banner: accept all cookies. Revisit the same pages and document the additional cookies that appear. This gives you the complete picture: cookies set without consent (which should only be necessary cookies) and cookies set after consent (analytics, marketing, functional).

Step 5: Identify each cookie

For each cookie you have recorded, determine the following:

  • Name: The exact cookie name (e.g., _ga, _fbp, PHPSESSID)
  • Domain: Which domain sets it (your domain = first-party; another domain = third-party)
  • Source: Which service or script creates it (Google Analytics, Facebook, your CMS, a plugin)
  • Purpose: What the cookie actually does (session management, user identification, cross-site tracking, preference storage)
  • Expiry: How long the cookie persists (session, days, months, years)
  • Type: First-party or third-party
  • Category: Necessary, analytical, marketing or functional

For common cookies, databases like cookiedatabase.org, cookiepedia.co.uk and the IAB's cookie guide provide standardised descriptions. For proprietary or less common cookies, you may need to consult the documentation of the third-party service that sets them.

Step 6: Categorise the cookies

Assign each cookie to the correct GDPR consent category. The standard classification used by most consent management platforms is:

  • Strictly necessary: Cookies essential for the website to function: session cookies, security tokens, shopping basket cookies, load balancer cookies. These do not require consent under the ePrivacy Directive.
  • Functional/Preferences: Cookies that enhance functionality but are not strictly necessary: language preferences, region selection, accessibility settings. These require consent.
  • Analytics/Statistics: Cookies used to measure website usage and performance: Google Analytics (_ga, _gid), Hotjar (_hj*), Matomo. These require consent.
  • Marketing/Advertising: Cookies used for advertising, remarketing and cross-site tracking: Facebook Pixel (_fbp, _fbc), Google Ads (IDE, _gcl_*), LinkedIn Insight Tag, TikTok Pixel. These require consent.

Be honest and conservative with categorisation. A common mistake is classifying analytics cookies as "functional" or treating social media tracking pixels as "necessary." If a cookie's primary purpose involves collecting data about user behaviour or enabling targeted advertising, it belongs in the analytics or marketing category, respectively.

The average website uses 20–50 different cookies. E-commerce sites with multiple third-party integrations often use over 100. Without a systematic audit, it is virtually impossible to maintain an accurate cookie declaration.

Beyond cookies: other tracking technologies

A thorough audit should not stop at cookies. The ePrivacy Directive's consent requirement applies to all information stored on or read from a user's device, which includes:

  • Local Storage and Session Storage: Many modern tracking tools use the Web Storage API instead of (or in addition to) cookies. Open DevTools and check Application > Local Storage and Session Storage.
  • IndexedDB: Some services store data in IndexedDB, a more powerful client-side database.
  • Fingerprinting scripts: Scripts that collect device characteristics (screen resolution, installed fonts, browser version) to create a unique identifier without storing anything on the device. These are harder to detect but still require consent if used for tracking.
  • Tracking pixels and web beacons: Invisible images (typically 1x1 pixel) that trigger server requests and can set cookies. They are commonly used by email marketing tools and advertising platforms.

Automated audit tools

Manual auditing is thorough but time-consuming, especially for large websites with hundreds of pages. Automated cookie scanning tools can supplement (though not entirely replace) manual inspection:

  • Cookiebot Scanner: A free online scanner that crawls up to 5 pages and produces a cookie report. Useful for a quick overview but limited in scope.
  • OneTrust CookiePro: An enterprise-grade scanner with deep crawling capabilities. Suitable for large organisations with complex websites.
  • Consentio Scanner: Integrated into the Consentio platform, our scanner automatically detects all cookies and tracking technologies on your website, categorises them and keeps your cookie declaration up to date with regular rescans.
  • Browser extensions: Tools like Ghostery and Privacy Badger can help identify third-party trackers, though they are designed for end-user privacy rather than compliance auditing.

When evaluating automated tools, consider the crawl depth (how many pages the scanner visits), the frequency of rescans, the accuracy of automatic categorisation, and whether the tool detects non-cookie tracking technologies (local storage, fingerprinting).

Common audit findings and how to address them

After conducting dozens of cookie audits, certain patterns emerge repeatedly:

  • Pre-consent cookie loading: Google Analytics, Facebook Pixel or Hotjar loads before the user interacts with the cookie banner. Fix: ensure your tag manager or consent management platform blocks these scripts until consent is given.
  • Undeclared cookies from plugins: WordPress plugins, Shopify apps or embedded widgets set cookies that are not listed in your cookie policy. Fix: audit your plugin list and test each plugin's cookie behaviour individually.
  • Stale cookie declarations: Your cookie policy lists cookies that no longer exist (from a tool you removed months ago) or omits cookies from tools you recently added. Fix: re-audit regularly and keep your declarations in sync.
  • Miscategorised cookies: Analytics or marketing cookies classified as "necessary" or "functional." Fix: review each cookie's actual purpose and recategorise honestly.
  • Excessive cookie lifetimes: Some cookies persist for years (the Facebook _fbp cookie, for example, has a 90-day expiry). While you cannot control third-party cookie lifetimes directly, you should disclose them accurately and consider whether such long retention periods are proportionate to the purpose.

Documenting your audit

Create a structured spreadsheet (or use your consent management platform's built-in registry) that records, for each cookie: name, domain, source/service, purpose, category, expiry, first-party or third-party status, and the date the entry was last verified. This document serves as your cookie register: the compliance equivalent of an asset inventory. Keep it updated and version-controlled so you can demonstrate due diligence in the event of a regulatory inquiry.

Auditing with Consentio

Consentio automates the most labour-intensive parts of the cookies audit. When you add your website to Consentio, our scanner automatically crawls your pages, identifies all cookies and tracking technologies, classifies them into the standard GDPR categories and generates a complete cookie declaration. Regular rescans ensure that your declaration stays accurate as your website evolves: new cookies are flagged for your review, and removed cookies are cleaned up automatically.

The result is a cookie audit that is always current, always accurate and always ready for regulatory inspection. Combined with Consentio's compliant consent banner, you get end-to-end cookie compliance from scanning through consent collection to documentation: all managed from a single dashboard.