# How to run a cookie audit on your website

> A step-by-step guide to auditing cookies and trackers: scope your site, capture what loads, categorize each item, test consent behavior and fix the gaps.

Source: https://www.cookiesh.eu/blog/how-to-run-a-cookie-audit  
Published: 2026-05-07

## Key takeaways

- A cookie audit is a structured inventory of every cookie and similar technology your site uses, who sets it, why and for how long.
- Audit from a clean browser with no stored consent, because that is the state new visitors and regulators see first.
- Look beyond cookies: local storage, session storage and tracking pixels also fall under device-storage and access rules.
- Test every key page template in three states: before any choice, after rejecting all and after accepting all.
- Repeat the audit on a schedule and after every release that adds or changes third-party tags.

A cookie audit is a structured review of every cookie and similar tracking technology your website uses: what it is, who sets it, why, for how long, and whether it waits for consent. To run one, define your scope, load the site in a clean browser, capture everything stored or accessed, categorize each item, test behavior before and after consent, then fix the gaps.

## Why does a cookie audit matter?

You cannot collect valid consent, write an accurate cookie policy or answer a regulator's questions without knowing what your site actually does. An audit replaces assumptions with a verified inventory.

Under Article 5(3) of the ePrivacy Directive, storing or accessing information on a user's device generally requires consent unless it is strictly necessary for a service the user requested. That rule covers cookies, but also local storage, pixels and similar techniques. Most sites accumulate tags over time through marketing tools, embedded videos, chat widgets and A/B testing scripts, and few teams know exactly what each one sets.

An audit also surfaces waste. Abandoned tags that still load, duplicate analytics tools and vendors nobody remembers adding all cost page speed and create risk for no benefit.

## What should you prepare before you start?

Agree on scope and gather context before you open your browser's developer tools. A short preparation phase prevents the most common mistake, which is auditing only the homepage.

- **List domains and subdomains**, including marketing sites, app subdomains, help centers and checkout flows hosted elsewhere.
- **Pick representative page templates**: home, article, product, search, cart, checkout, sign-up and a logged-in dashboard.
- **Note regional variations.** If you show different banners by location, plan to test from each relevant region.
- **Export your tag manager container** and list your vendor contracts, so you can match each finding to a known owner.
- **Collect your current cookie policy** so you can compare it with reality at the end.

## How do you run a cookie audit step by step?

Work through the site in a clean state, capture everything, then record it in an inventory. The steps below describe a manual audit; an automated scanner follows the same logic at scale.

1. **Start clean.** Open a fresh browser profile or private window with extensions disabled and no stored consent. If you geo-target banners, connect from the region you are testing.
2. **Load each template without touching the banner.** This is the state that matters most: anything non-essential set here is set before consent.
3. **Capture storage.** In your browser's developer tools, check the cookie list for every domain, plus local storage, session storage and IndexedDB.
4. **Capture network requests.** Filter the network panel for third-party domains and note tracking pixels, beacons and scripts, even if they set no cookie.
5. **Walk key journeys.** Search, add to cart, submit a form, log in and play an embedded video, because many tags fire only on interaction.
6. **Repeat after rejecting all, then after accepting all.** Clear storage between runs so each result reflects one consent state.
7. **Record each item** in your inventory using the fields in the next section.

A quick console snippet can speed up step 3. Note that `document.cookie` cannot see `HttpOnly` cookies or cookies that belong to other domains, so always confirm the full list in developer tools.

```js
// Run in the browser console on a fresh visit, before touching the banner
console.log('Cookies:', document.cookie.split('; ').filter(Boolean).map((c) => c.split('=')[0]));
console.log('localStorage:', Object.keys(localStorage));
console.log('sessionStorage:', Object.keys(sessionStorage));
```

## What should your cookie inventory include?

Each row should answer who, what, why and how long. These fields map directly onto what your banner and [cookie policy](/blog/how-to-write-a-cookie-policy) need to disclose.

| Field | Example | Why it matters |
| --- | --- | --- |
| Name | `_ga` | Identifies the item in your disclosures |
| Domain and provider | Google Analytics | Shows first or third party and who receives data |
| Type | Cookie, local storage, pixel | All fall under device-storage rules |
| Purpose | Distinguishes visitors for analytics | Drives the category |
| Category | Analytics | Determines whether consent is required |
| Duration | Expiry date or session | Must be disclosed and proportionate |
| Set before consent? | Yes or no | Flags compliance gaps |
| Owner | Growth team | Someone must justify keeping it |

## How do you categorize what you find?

Assign each item to one purpose category, using the narrowest honest description of what it does. Most consent tools use four categories: necessary, preferences, analytics and marketing.

The hard calls are usually about "necessary." Only items required to deliver a service the user explicitly asked for belong there, such as a shopping cart session cookie or a load-balancing cookie. Analytics, A/B testing and advertising cookies generally do not qualify, even if the business considers them essential. See [what counts as a strictly necessary cookie](/blog/strictly-necessary-cookies) for the edge cases.

If you cannot find a purpose or owner for an item, treat that as a finding in itself. Unknown tags are candidates for removal, not for the necessary category. For a refresher on first-party, third-party, session and persistent cookies, read our overview of [types of cookies](/blog/types-of-cookies).

## How do you fix gaps and keep the audit current?

Turn findings into a short remediation list, ship the fixes, then re-test the same pages in the same three states. Typical fixes fall into four groups.

- **Remove** tags with no owner or purpose.
- **Block until consent** anything non-essential that loads on the first visit. Our guide to [blocking third-party scripts until consent](/blog/block-scripts-until-consent) covers the techniques.
- **Shorten durations** that last longer than the purpose needs.
- **Update disclosures** in the banner and cookie policy so they match the inventory exactly.

Then make auditing routine. Re-run the audit on a fixed schedule, such as quarterly, and whenever a release adds a tag, vendor or embed. Keep each audit's output with a date, so you can show how your setup changed over time and when issues were fixed.

## Bottom line

A cookie audit is the foundation of every other consent decision, because categories, banner text, your cookie policy and script blocking all depend on it. Start from a clean state, capture more than just cookies, test every consent state and repeat the process regularly. Tools like Cookiesh can automate the scanning step, but decisions about purpose and necessity still need a human owner.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### How long does a cookie audit take?

For a small site with a handful of templates, a manual audit can take a few hours. Large sites with many tags, regions and logged-in areas usually need automated scanning plus manual spot checks spread over several days.

### Can I rely only on an automated cookie scanner?

Scanners are excellent for coverage and repeatability, but they can miss items set behind logins, forms or specific user actions. Pair automated scans with manual testing of key journeys such as checkout, sign-up and account pages.

### Who should own the cookie audit?

It works best as a shared task. Engineering captures and fixes what loads, marketing explains why each tag exists, and a privacy lead signs off on categories and the final cookie policy.

### Do I need a cookie audit if my visitors are mostly in the US?

Yes. Laws such as California's CCPA require you to disclose what you collect and to let people opt out of the sale or sharing of their data, which you cannot do accurately without knowing which trackers run.

## Sources

- [Directive 2002/58/EC (ePrivacy Directive), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)
- [MDN: Using HTTP cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)