Cookiequiet

FeaturesPricingFree toolsLawsPlatformsCompareGuidesBlogFAQGlossary
FRStart freeLog in
Guides

Cookie audit checklist: find every cookie and tracker on your site

A cookie audit lists every cookie, script and embed your site loads, who sets it, why, and whether it runs before consent. Here is a checklist you can finish in an afternoon.
Published 20 October 2026 · By the Cookiequiet team · Markdown

A cookie audit answers four questions for every piece of storage on your visitors' devices: what is it, who sets it, why, and does it wait for consent. The output is a table you can paste into your cookie policy and a list of fixes. You can do it with a browser's developer tools and a scanner in an afternoon, and you should repeat it whenever the site changes, because tags added through a tag manager or a plugin update are how most sites drift out of compliance.

Why audit, and why regularly

The EDPB's cookie banner taskforce noted in 2023 that the features of cookies change regularly, which prevents any stable list of "essential" cookies, and that website owners are responsible for maintaining the list of cookies they use and for demonstrating why each one they call essential really is. The report also observes that the available scanning tools list the cookies placed but cannot tell what they are for; that part is your job.

Three recent CNIL fines came from facts an audit would have caught: Shein (€150 million, September 2025) placed advertising cookies as soon as visitors arrived, before any interaction with the banner; Condé Nast (€750,000, November 2025) presented cookies as "strictly necessary" without useful information about their purposes and kept setting cookies after "Refuse all"; Orange (€50 million, November 2024) kept reading cookies after visitors withdrew consent, which the CNIL said is prohibited even when the data is never used.

The checklist

1. Inventory

  • Cookies set by HTTP headers (visible in the Network tab, Set-Cookie) and by JavaScript (visible in the Application tab).
  • Local storage, session storage and IndexedDB entries. The rules cover any storage on the device, not only cookies.
  • Every third-party script, including those injected by Google Tag Manager or a plugin.
  • Iframes: video players, maps, booking widgets, payment forms, social feeds.
  • Tracking pixels (image requests to advertising hosts) and beacons.
  • Font and CDN requests to third-party hosts: they are not cookies, but they transmit the visitor's IP address. See the Google Fonts guide.

Capture the inventory three times: on a fresh private window before touching the banner, after Reject all, and after Accept all. Do it on the home page and on the pages that differ: a product page, a checkout, a blog post with embeds, a contact form.

2. Attribution

For each item, write down the provider (your own site, Google, Meta, a chat vendor), the purpose in one sentence a visitor would understand, and the duration. The CJEU's Planet49 judgment made duration and third-party access part of the information you owe the visitor.

3. Classification

Sort each item into necessary, functional, analytics or marketing. Be strict with "necessary": session, cart, security, load balancing, the consent choice itself, and little else. Analytics is not necessary. A chat widget that loads on every page is not necessary either, however useful.

Nothing from the non-necessary groups may run before the visitor chooses. If the "before any click" capture shows a _ga cookie, a Meta Pixel request or a YouTube iframe, the banner is decorative. The fix is in the script blocking guide.

5. Behaviour after refusal and withdrawal

After Reject all, the capture should look like the "before" capture. After accepting and then withdrawing from the preferences centre, existing cookies should stop being read; deleting them is the clean way to be sure.

6. The banner itself

  • Accept all and Reject all on the first layer, same size (see the Reject all guide).
  • No pre-ticked optional category.
  • Purposes explained, third parties named or reachable in a clearly signposted second layer.
  • A way to reopen the preferences from every page.
  • Keyboard and screen-reader operable.

7. Information and records

  • The cookie policy matches the inventory: same names, same providers, same durations.
  • The privacy policy lists the processors and the transfers.
  • Each choice is logged with a timestamp, the banner version and the categories, so you can show it later. See how long to keep consent records.

8. Schedule

Put a reminder in the calendar: after every tag manager change, every new plugin, every redesign, and at least every few months regardless.

A table to fill in

NameSet byPurposeCategoryDurationBefore consent?After reject?
_gaGoogle Analytics 4Distinguishes visitorsAnalytics2 yearsnono
_fbpMeta PixelAd attributionMarketing3 monthsnono
cq_consentYour siteStores the cookie choiceNecessary6 monthsyesyes
PHPSESSIDYour siteSessionNecessarySessionyesyes

The last two columns are the ones that matter for compliance. Any "yes" in a non-necessary row is a finding.

Tools that help

A scanner does the inventory faster than clicking through pages. The free Cookiequiet scanner crawls up to five pages without an account, lists scripts, iframes, stylesheets, beacons and Set-Cookie headers, names the providers it recognises, and tells you whether a consent tool and Consent Mode are already present. It reads the HTML as served, without running JavaScript unless the rendered option is configured, so cookies set only by scripts are listed from its provider database rather than observed; the developer tools pass described above completes the picture. How the scanner works explains what it can and cannot see.

Questions

After every change that can add a tag (a plugin, a tag manager container, a new embed) and at a fixed interval in between. Weekly automatic rescans catch most drift; a manual pass with developer tools once or twice a year catches what scanners cannot see.
The information must be clear and comprehensive, and the CJEU requires duration and third-party access to be stated. A table with name, provider, purpose and duration is the standard way to meet that. Grouping by provider is acceptable as long as each cookie is identifiable.
The rules apply to any information stored on, or read from, the device, whatever the technology. The ICO lists local storage, tracking pixels, link decoration and device fingerprinting alongside cookies. Audit them the same way.
It can do the inventory and a first classification, and it can run on a schedule. It cannot know whether a script you wrote is necessary, see what a tag manager injects unless it renders the page, or judge the banner design. Treat it as the first pass.

Sources

Related

Do I need a cookie banner? A plain answerYou need a cookie banner when your site sets cookies or trackers that are not strictly necessary, for visitors in the EU, the UK or another consent country. Here is how to tell.How to write a cookie policy (with a structure you can copy)A cookie policy tells visitors which cookies and trackers you use, why, for how long, who else gets the data and how to change their choice. What to include, section by section.Block scripts until consent: the four methods that workTo block a tracker until consent, mark its script tag as text/plain with a category, swap embed URLs for data-cq-src, or let the auto-blocker hold known trackers created by JavaScript.
Back to Guides

Put a quiet banner on your website today

Free for one website with every core feature, no card and no trial clock. Upgrade a website to Starter for $3 a month to match your brand with AI and drop the branding, or to Pro for $9 to design it with the AI agent.
Start free, no cardSee pricing