Home / Blog / How do I find out what cookies my website sets?

How do I find out what cookies my website sets?

The fastest way is a browser check: open your browser's developer tools, visit your own site, and look at the cookies set under Application or Storage. For a complete picture across pages and third-party scripts, an automated cookie scan crawls the site and catalogs every tracker, including ones that only appear on deeper pages.

The manual check

In Chrome, open DevTools, go to Application, then Cookies, and reload your homepage. Everything listed was set on that visit. Repeat on a few key pages like checkout and blog posts, and click around, since some trackers fire only after interaction. This takes minutes and catches the obvious ones.

Why manual checks miss things

Third-party scripts load conditionally: some cookies appear only for visitors from certain regions, after a video plays, or when an ad fills. A single manual pass through a few pages rarely sees the full set. Trackers also change over time as plugins and embeds update.

The ongoing answer

A recurring automated scan crawls your pages on a schedule, inventories every cookie and script, and flags changes. That turns a one-time audit into continuous monitoring, which matters because a site that was clean last month can start setting new trackers after any plugin, theme, or embed change.

Frequently asked questions

Why would a consent string not match what the visitor clicked?

The usual causes are a stale cached copy of the string, a vendor reading the string before the banner finished writing it, or a tag manager firing vendors without checking the current value. Each one leaves a valid banner choice and a broken downstream signal.

Does the consent string matter for non-advertising vendors?

Yes, whenever a vendor processes personal data based on consent. Analytics tools, chat widgets, and video embeds all need to see and honor the recorded choice, even when they are not part of the ad-tech framework that defined the original string format.

Can visitors see or change their stored consent string?

They can change the underlying choice through your banner's preference center or a re-open link, which rewrites the string. The raw encoded value is not meant for visitors to read, which is why your site should make the human-readable choice easy to revisit.

Is keeping old consent strings a privacy risk?

A consent string is personal data because it records an individual's choice. Keep it only as long as your retention schedule requires for evidence, store the minimum the string needs, and include it in your deletion-request handling.

Get a free consent audit of your website

Free consent audit