# Cookie audit checklist: find every cookie and tracker on your site

> A cookie audit lists every cookie, script and embed your site loads, who sets it, why, and whether it runs before consent. A checklist for one afternoon.

Source: https://cookiequiet.com/guides/cookie-audit-checklist
Published: 2026-10-20
Publisher: Cookiequiet

## Steps

1. **Capture the site before any click** In a fresh private window with the developer tools open, load the home page and four representative pages. Record cookies, local storage and third-party requests before interacting with the banner.
2. **Capture after Reject all and after Accept all** Repeat the same pages after refusing, then after accepting. The three captures show what each path really does.
3. **Run a scanner for coverage** Scan the site to find providers on pages you did not open by hand, including iframes, beacons and stylesheets, and to get a first classification.
4. **Attribute and classify every item** Write the provider, a one-sentence purpose, the duration and the category for each cookie, script and embed. Keep the necessary category strict.
5. **List the findings** Every non-necessary item present before consent or after refusal is a finding. So is any cookie labelled necessary without a reason, and any mismatch with the cookie policy.
6. **Fix and re-test** Mark or move scripts so they wait for consent, replace embeds with placeholders, correct the categories, update the policy, then repeat the three captures.
7. **Schedule the next audit** Re-run the scan after each tag or plugin change and at least every few months. Keep each audit's table as a record.

A cookie audit answers four questions for every piece of storage on your visitors' devices: what is it, who sets it, why, and does it wait for consent. The output is a table you can paste into your cookie policy and a list of fixes. You can do it with a browser's developer tools and a scanner in an afternoon, and you should repeat it whenever the site changes, because tags added through a tag manager or a plugin update are how most sites drift out of compliance.

## Why audit, and why regularly

The EDPB's cookie banner taskforce noted in 2023 that the features of cookies change regularly, which prevents any stable list of "essential" cookies, and that website owners are responsible for maintaining the list of cookies they use and for demonstrating why each one they call essential really is. The report also observes that the available scanning tools list the cookies placed but cannot tell what they are for; that part is your job.

Three recent CNIL fines came from facts an audit would have caught: Shein (€150 million, September 2025) placed advertising cookies as soon as visitors arrived, before any interaction with the banner; Condé Nast (€750,000, November 2025) presented cookies as "strictly necessary" without useful information about their purposes and kept setting cookies after "Refuse all"; Orange (€50 million, November 2024) kept reading cookies after visitors withdrew consent, which the CNIL said is prohibited even when the data is never used.

## The checklist

### 1. Inventory

- Cookies set by HTTP headers (visible in the Network tab, Set-Cookie) and by JavaScript (visible in the Application tab).
- Local storage, session storage and IndexedDB entries. The rules cover any storage on the device, not only cookies.
- Every third-party script, including those injected by Google Tag Manager or a plugin.
- Iframes: video players, maps, booking widgets, payment forms, social feeds.
- Tracking pixels (image requests to advertising hosts) and beacons.
- Font and CDN requests to third-party hosts: they are not cookies, but they transmit the visitor's IP address. See [the Google Fonts guide](/guides/google-fonts-gdpr).

Capture the inventory three times: on a fresh private window before touching the banner, after Reject all, and after Accept all. Do it on the home page and on the pages that differ: a product page, a checkout, a blog post with embeds, a contact form.

### 2. Attribution

For each item, write down the provider (your own site, Google, Meta, a chat vendor), the purpose in one sentence a visitor would understand, and the duration. The CJEU's Planet49 judgment made duration and third-party access part of the information you owe the visitor.

### 3. Classification

Sort each item into necessary, functional, analytics or marketing. Be strict with "necessary": session, cart, security, load balancing, the consent choice itself, and little else. Analytics is not necessary. A chat widget that loads on every page is not necessary either, however useful.

### 4. Behaviour before consent

Nothing from the non-necessary groups may run before the visitor chooses. If the "before any click" capture shows a `_ga` cookie, a Meta Pixel request or a YouTube iframe, the banner is decorative. The fix is in [the script blocking guide](/guides/block-scripts-until-consent).

### 5. Behaviour after refusal and withdrawal

After Reject all, the capture should look like the "before" capture. After accepting and then withdrawing from the preferences centre, existing cookies should stop being read; deleting them is the clean way to be sure.

### 6. The banner itself

- Accept all and Reject all on the first layer, same size (see [the Reject all guide](/guides/reject-all-button)).
- No pre-ticked optional category.
- Purposes explained, third parties named or reachable in a clearly signposted second layer.
- A way to reopen the preferences from every page.
- Keyboard and screen-reader operable.

### 7. Information and records

- The cookie policy matches the inventory: same names, same providers, same durations.
- The privacy policy lists the processors and the transfers.
- Each choice is logged with a timestamp, the banner version and the categories, so you can show it later. See [how long to keep consent records](/guides/how-long-to-keep-consent-records).

### 8. Schedule

Put a reminder in the calendar: after every tag manager change, every new plugin, every redesign, and at least every few months regardless.

## A table to fill in

| Name | Set by | Purpose | Category | Duration | Before consent? | After reject? |
|---|---|---|---|---|---|---|
| `_ga` | Google Analytics 4 | Distinguishes visitors | Analytics | 2 years | no | no |
| `_fbp` | Meta Pixel | Ad attribution | Marketing | 3 months | no | no |
| `cq_consent` | Your site | Stores the cookie choice | Necessary | 6 months | yes | yes |
| `PHPSESSID` | Your site | Session | Necessary | Session | yes | yes |

The last two columns are the ones that matter for compliance. Any "yes" in a non-necessary row is a finding.

## Tools that help

A scanner does the inventory faster than clicking through pages. The free [Cookiequiet scanner](/tools/cookie-scanner) crawls up to five pages without an account, lists scripts, iframes, stylesheets, beacons and Set-Cookie headers, names the providers it recognises, and tells you whether a consent tool and Consent Mode are already present. It reads the HTML as served, without running JavaScript unless the rendered option is configured, so cookies set only by scripts are listed from its provider database rather than observed; the developer tools pass described above completes the picture. [How the scanner works](/blog/how-the-cookiequiet-scanner-works) explains what it can and cannot see.

## Questions

### How often should I audit cookies?

After every change that can add a tag (a plugin, a tag manager container, a new embed) and at a fixed interval in between. Weekly automatic rescans catch most drift; a manual pass with developer tools once or twice a year catches what scanners cannot see.

### Do I have to list every cookie by name in the policy?

The information must be clear and comprehensive, and the CJEU requires duration and third-party access to be stated. A table with name, provider, purpose and duration is the standard way to meet that. Grouping by provider is acceptable as long as each cookie is identifiable.

### Does local storage count as a cookie?

The rules apply to any information stored on, or read from, the device, whatever the technology. The ICO lists local storage, tracking pixels, link decoration and device fingerprinting alongside cookies. Audit them the same way.

### Can a scanner do the whole audit for me?

It can do the inventory and a first classification, and it can run on a schedule. It cannot know whether a script you wrote is necessary, see what a tag manager injects unless it renders the page, or judge the banner design. Treat it as the first pass.

## Sources

- [EDPB, Report of the work undertaken by the Cookie Banner Taskforce, section on inaccurately classified essential cookies](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf)
- [CNIL, Cookies placed without consent: SHEIN fined 150 million euros (decision of 1 September 2025, press release of 3 September 2025)](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil)
- [CNIL, Advertisements inserted among emails: ORANGE fined €50 million (decision of 14 November 2024, press release of 10 December 2024)](https://www.cnil.fr/en/advertisements-inserted-among-emails-orange-fined-eu50-million)
- [CJEU, press release on Planet49 (C-673/17), 1 October 2019](https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf)
- [ICO, Guidance on the use of storage and access technologies: how do we manage consent in practice?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-manage-consent-in-practice/)