How to Audit Cookies on Your Website
Last updated: October 16, 2026
Start with pages and visitor journeys
A cookie audit should establish which services run, when they start, and whether their behavior matches the visitor’s selection. List representative pages before collecting results: the homepage, a product page, contact forms, checkout, and pages with embedded content.
Record expected integrations for each page. A chat may load only in the catalogue, while a payment provider appears during checkout. This inventory makes unexpected services easier to investigate and gives your developer a clear testing scope.
Inspect browser storage
In Chrome DevTools, open Application → Storage → Cookies and select an origin. Record cookie names, domains, paths, and expiry information. These fields describe storage; they do not establish why the service uses it.
Create an inventory with the page, service, purpose, lifetime, and the action that first produced the cookie. Avoid copying visitor identifier values into shared tickets. Names and reproduction steps are usually more useful for debugging.
Assign categories using evidence
Check the integration code and provider documentation before assigning a purpose. A familiar name or first-party domain is not enough to classify an item. Keep uncertain entries marked for investigation and assign someone to resolve them.
Use categories such as session functionality, preferences, statistics, and marketing as a working inventory. Do not move an unknown tracker into the necessary category simply to keep it running.
Compare consent scenarios
Test a fresh visit, rejection of optional categories, statistics-only consent, and acceptance of all categories. Start independent scenarios with clean site state. For a prior-consent configuration, define which services should remain inactive before testing.
After each choice, navigate and trigger relevant interactions such as opening chat or playing a video. Record expected and observed behavior. A scan of the homepage alone cannot cover these journeys.
Check requests and turn findings into fixes
Use Network to inspect requests as well as stored cookies. Open the panel before reloading and inspect the address and initiator of unexpected requests. An empty cookie inventory does not prove that no data leaves the browser.
Treat an automated scan as a starting point tied to its tested pages and conditions. Group fixes into unknown integrations, duplicate installations, incorrect categories, and early execution. Retest after changes to templates, tags, or embedded services. Cookiestack’s scanner can help start that inventory; manual checks complete the picture.
Guides and next steps
Set up Cookiestack for your website →