Scanning
How to scan and classify website cookies
Turn scan results into a reviewed cookie and vendor inventory.
Run representative scans
Scan the home page plus templates that load different vendors: checkout, account, media, campaign and embedded-content pages. Scheduled scans catch later drift.
Build a repeatable cookie audit scope
Before a beta scan, confirm access and the plan’s scan limits. Select representative public URLs: a landing page, a product or service page, a media page and a conversion journey. Record browser state, region and whether the visitor has made a choice. Authenticated pages and actions require a separately agreed test method.
Compare at least a fresh visit, reject and accept. A cookie detected only after opening a video needs that trigger documented. A clean homepage scan does not prove that checkout, campaign pages or backend forwarding are free of optional tracking.
Review findings
Automated classification is a starting point. Confirm the owner, purpose, storage duration, data destination and category against vendor documentation and your contracts.
Record the page and trigger that produced each finding. This turns a scanner result into an actionable issue for the team that owns the tag, component or vendor relationship.
Once the inventory is reviewed, turn it into prior-blocking rules and retest the same journeys.
Resolve unknowns
Do not automatically allow an unknown technology. Investigate it, assign an owner and either classify it or remove it before release.
Review server-side event forwarding too. A browser scan is essential, but it may not reveal data that your backend sends to an advertising or analytics destination after a form or checkout action.