Cookie Audit and Classification Toolkit
Classify Every Cookie, and Record Why , Not Just What
Four categories, a lawful basis per individual cookie, mapped to what regulators expect.
You have the cookie list. You still can't defend it.
You know which analytics cookies sit on your site, but you are never sure which ones genuinely need consent and which can rest on legitimate interest. Category-level labelling is not enough: a first-party analytics cookie with ad features disabled sits in a materially different position than one that shares data with an ad network. Most teams configure a consent banner before knowing exactly what their site actually sets, which opens a gap between the published policy and real site behaviour. That gap is precisely what regulators scan for.
Cookie Audit and Classification Toolkit
Get instant access to the toolkit
- Written around real GDPR, ePrivacy & CCPA requirements
- 26-page toolkit across 8 sections
- Includes the 15-field register schema and lawful-basis mapping table
Download your copy
The figures that set the benchmarks
Why lawful basis is decided cookie by cookie
Under GDPR Article 5(1)(b), each category must map to a specified, explicit purpose before it appears in your banner or policy. Analytics cookies that involve any third-party sharing or profiling require consent under Article 6(1)(a), not legitimate interest, and advertising identifiers require consent in every EU and UK context. The toolkit walks the lawful-basis analysis for each type and shows why first-party versus third-party is a risk multiplier, not a category of its own. It ends with recording the decision and its rationale for each individual cookie, the level of granularity regulators expect to see.
What you can do once you've read it
Grounded in the actual regulatory record
Every claim traces to a named article, ruling, or guideline, not vague best practice.
Before you download
It depends on the cookie. The toolkit gives three test questions: is the data shared with any third party, is the profile linked to an advertising identifier, and does the vendor build its own datasets. Any third-party sharing or profiling requires consent under Article 6(1)(a); only strictly anonymous aggregate measurement for the publisher's sole benefit may qualify for a narrow basis.
Both. It is a 26-page toolkit across 8 sections covering the full lifecycle, with the register schema, the lawful-basis mapping table, benchmark durations, and pass/fail examples you apply to your own cookies.
Yes. It is written for analysts who have a list but cannot yet defend why each cookie sits where it does. It takes you from a list to a per-cookie lawful basis with a documented rationale.
It is written primarily around EU and EEA law, draws on UK ICO guidance, and addresses US state requirements including CCPA/CPRA sale/sharing and Global Privacy Control signals. Coverage of the UK and US is partial, and it is educational, not legal advice.
Yes. It specifies concrete scan configuration: an unauthenticated baseline, authenticated crawls per user role, scripted user journeys, and consolidating per-subdomain results, so your classification rests on complete data.
Cookie Audit and Classification Toolkit