Cookie Inventory and Scanning
The consent manager holds an inventory of cookies, and can scan your site to find them.
Where to find it
Architect Panel → Security:
- Cookie Consent — categories, services, cookies, scans and records
The inventory
Each entry records the cookie’s name and how it is matched, its domain, its category and service, its provider, its purpose, its expiry, what kind of storage it is, whether it is first-party, where it came from, and when it was last seen.
That is the cookie table a privacy notice needs, maintained as data rather than written by hand and immediately out of date.
Match modes matter
Many cookies have generated names with a fixed prefix. Matching by pattern rather than exact name is what keeps the inventory accurate as those names change.
The scan finds what you did not know about
A scan requests pages, records what gets set, and reports findings — how many pages were scanned, how many cookies found, and how many are new.
Cookies discovered this way are marked as coming from a scan, so you can see which entries you declared and which the site is actually setting.
The gap between the two is the point
Every organisation believes it knows what its site sets. The first scan reliably finds things nobody declared — an embedded video, a font service, a chat widget, a tag added for a campaign.
Each of those is a third party receiving your visitors’ data, and each needs categorising or removing.
Scan after changes
New pages, new embeds, new integrations and new campaigns all bring cookies. A scan after any significant change, and periodically regardless, keeps the inventory honest.
Last seen tells you what to prune
A cookie in the inventory that scans no longer find is one you can probably remove — the service was retired and nobody updated the notice. Keeping the list current is as important as building it.
Categorise every finding
An uncategorised cookie is one the consent manager cannot govern. Each finding should be assigned to a category and a service, or the thing setting it should be removed.
Publish the inventory
A cookie table in your privacy notice, generated from this rather than written separately, is accurate by construction. Two hand-maintained lists diverge within a month.
Worked example
An organisation’s first scan found eleven cookies it had not declared, five from an embedded map on one page. The map was replaced with a static image, three findings were categorised, and the remainder came from a chat widget that was registered as a service. Scans now run after each release.
Recommendations
- Run a scan before you write anything — assumptions are wrong.
- Match by pattern where names are generated.
- Categorise every finding or remove its source.
- Publish the inventory from this list, not a hand-written one.