The Complete Cookie Audit Guide
Classify Every Cookie to the Right Category and Legal Basis
A list of cookie names is not a classification
You can run a scan and get a list of cookie names and domains in minutes. Turning that list into a correctly classified, documented inventory, one that assigns each cookie and advertising identifier the right category and legal basis, is the part that actually holds up. Without it, you cannot show that consent was informed or specific, and every consent banner on your site rests on an uncertain foundation. This guide walks the classification and documentation work that closes that gap.
Free download
Get instant access to the guide
- The four GDPR-aligned categories with legal basis for each
- A worked example inventory record for a real cookie
- The 14+ fields a defensible record must contain
Download the guide
Why a one-time audit is indefensible
Most organizations treat a cookie audit as a project: scope it, scan, update the policy, close the ticket. But inventories degrade within weeks as marketing teams add analytics tags, A/B testing platforms introduce cookies without change control, and vendors update scripts that embed new third-party pixels. Under the GDPR accountability principle, compliance must be demonstrable over time, not claimed once. A stale inventory means your consent notices are likely misstating what cookies are actually active.
Defend every classification to a regulator
Assign the correct category and Article 6 legal basis to each cookie, so your decisions stand up to a complaint, sweep, or DSAR.
Answer an Article 15 request with real records
Produce a complete, consistent inventory record for any cookie instead of reconstructing it from memory or server logs.
Catch the trackers that scans miss
Name and handle CNAME-cloaked trackers, shadow tags, prior-consent firing, and policy drift before they become enforcement findings.
Keep your inventory accurate between reviews
Run the scan triggers and reconciliation steps that keep any given day's data collection defensible, not just the day you last scanned.
Yes. Classification is the focus, but the nine chapters walk the full lifecycle: scanning, classification, inventory, third-party review, policy documentation, and a sustainable audit cycle.
It focuses on cookie and consent requirements in the EU and EEA under the GDPR and ePrivacy Directive. It does not address the laws of the UK, US, Canada, or Brazil except where noted.
No. It is a general informational and educational reference, not a substitute for your Data Protection Officer, qualified legal counsel, or a compliance professional. Scan frequencies and lifetime thresholds cited are recommended practices, not legal requirements.
Privacy officers, data-governance and legal teams, and consent operators who already have a cookie list and need to turn it into a classified, documented inventory that holds up to an audit or DSAR.