How to read a cookie scan report

In this article

Run any website through a cookie scanner and you get back a long table of names you did not choose: _ga, _fbp, IDE, a dozen strings of random characters. It is tempting to skim the summary score and close the tab. That would be a mistake, because the useful part of a scan report is not its score but its evidence: what the browser stored, when, and who it talked to. Read that evidence in the right order and most reports reduce to three or four concrete fixes.

01What a scan actually does

A scanner is an automated browser. It opens your pages from a clean profile, as a first-time visitor would, and records three kinds of thing:

Storage. Cookies, but also localStorage, sessionStorage, IndexedDB and similar mechanisms that let a site keep information on the visitor’s device.
Network requests. Every host the page contacts: your own server, content delivery networks, font services, analytics and advertising endpoints, embedded video players.
Behaviour over time. Better scanners repeat the visit in different consent states: before any choice, after clicking “reject”, and after clicking “accept”.

Everything else in the report is interpretation built on these observations: the category a cookie is sorted into, the vendor it is attributed to, the warning attached to it. Interpretation can be wrong. The observations, if the scan ran properly, are facts about what your site did at that moment.

02The rules the report measures against

Two pieces of EU law do most of the work.

Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC, as amended in 2009) says that storing information on a user’s device, or reading information already stored there, is allowed only with the user’s consent, after clear and comprehensive information. There are two exceptions: storage needed purely to transmit a communication, and storage strictly necessary to provide a service the user has explicitly asked for. The rule is not limited to cookies and not limited to personal data. In its Guidelines 2/2023 on the technical scope of Article 5(3), the European Data Protection Board (EDPB) explains that it can also cover techniques such as tracking pixels, local storage and some forms of fingerprinting.

The GDPR (Regulation (EU) 2016/679) defines what valid consent is: freely given, specific, informed and an unambiguous indication of the user’s wishes, by a statement or a clear affirmative action (Article 4(11)), which can be withdrawn as easily as it was given (Article 7(3)). The Court of Justice confirmed in Planet49 (Case C-673/17, 2019) that a pre-ticked checkbox is not valid consent for cookies, whether or not the information stored is personal data. Once the stored information is used to process personal data, the GDPR applies to that processing as well.

Article 5(3) is implemented in each member state’s national law and enforced by national authorities. That is why the details, and the enforcement climate, differ from country to country.

Most reports list each cookie or storage entry with a handful of columns. In order of importance:

Set before consent? The single most important column. Anything stored before the visitor has made a choice must fall within one of the two exceptions above.
Domain. First-party entries are set on your own domain; third-party entries belong to another host. A third-party domain is a strong hint that someone else receives the data, though first-party cookies set by third-party scripts are common too.
Lifetime. A session cookie disappears when the browser closes; others persist for months or years. Long lifetimes on cookies labelled “necessary” deserve a second look.
Category and vendor. These are the scanner’s guess, usually from a database of known cookie names. Treat them as a starting point, not a finding.

Typical examples of storage that can be strictly necessary are a session identifier for a shopping basket, a load-balancing cookie, a security token for a form, and the cookie that remembers the visitor’s consent choice itself. Analytics and advertising cookies are generally not strictly necessary in the sense of Article 5(3). A few national authorities, France’s CNIL among them, accept narrowly configured audience measurement without consent under strict conditions; that is a national position, not an EU-wide rule, so check the guidance in each country you target.

If your scanner tests more than one consent state, compare them side by side. The pattern you want is simple:

Before any choice: only strictly necessary storage, and no requests to analytics or advertising hosts.
After “reject”: the same as before any choice, plus the cookie that records the refusal. Nothing new from marketing or analytics vendors.
After “accept”: the full set of tools you described in your banner, and nothing you did not describe.

The two red flags that matter most are trackers that load before any choice, and trackers that keep loading after the visitor has said no. Both mean the banner is decoration rather than control. A third, quieter flag is the “after accept” state containing vendors your cookie notice never mentions: consent is only informed if the visitor was told who would receive their data.

05Network requests and third-party hosts

Some reports put requests in a separate list from cookies. Do not skip it. A request to a third-party server sends that server the visitor’s IP address, and often the address of the page being read. Under the GDPR an IP address is generally personal data, so every third-party host your page contacts on load is a recipient you need a legal basis for and should name in your privacy notice. If the host is outside the European Economic Area, the GDPR’s rules on international transfers come into play as well.

The best-known example is web fonts. In January 2022 the Regional Court of Munich (Landgericht München I, case 3 O 17493/20) held that a website which loaded Google Fonts from Google’s servers, passing visitors' IP addresses to Google without consent, had infringed a visitor’s rights, and awarded him damages of €100. The amount was small; the lesson was not. Self-hosting fonts, scripts and images removes a whole category of findings at once.

Requests without any cookie can still fall under Article 5(3) if they read or store information on the device, which is how tracking pixels and many fingerprinting scripts work. A report that shows a request to an advertising host before consent is worth investigating even if no cookie appears next to it.

Automated scans have predictable blind spots, and knowing them helps you judge a clean report as well as a messy one:

Pages behind a login or a checkout step are usually not scanned.
Interaction-triggered tags, for example scripts that load on scroll, on a click or after a delay, may not fire during a short automated visit.
Location and device. Many consent platforms show different banners by country or device. A scan from outside the EU, or from a desktop profile, may see a different site from your visitors.
Server-side tracking sends data from your server rather than the visitor’s browser. A browser-based scan cannot see it, though the law still applies to it.
Classification errors. Unknown cookie names are often filed under “unclassified” or guessed wrongly. Check the scripts that set them.

07Turning a report into fixes

Work through the findings in this order. It roughly follows the order in which regulators and complainants look at a site.

Anything non-essential set or sent before consent. Move the tag behind your consent tool so it fires only after “accept”, or remove it.
Anything that survives “reject”. Usually a tag loaded outside the consent tool, often hard-coded in a theme or added by a plugin.
Third-party requests you can avoid. Self-host fonts and libraries; replace embedded players and maps with a click-to-load placeholder.
The banner itself. Make refusing as easy as accepting, with no pre-ticked boxes. Our guide to consent banner dark patterns covers the designs regulators object to.
Your cookie notice and privacy notice. They should list the same tools, purposes, recipients and lifetimes that the scan found after “accept”.

Then scan again, and keep the reports. Under Article 5(2) GDPR a controller must be able to demonstrate compliance; a dated series of reports showing problems found and fixed is exactly the kind of record that helps.

08Sources and further reading

Primary legal texts and official guidance referred to above. Links go to the official publishers.

Directive 2002/58/EC (ePrivacy Directive), consolidated text (eur-lex.europa.eu)
Regulation (EU) 2016/679 (General Data Protection Regulation) (eur-lex.europa.eu)
Court of Justice of the EU, Case C-673/17 Planet49 (curia.europa.eu)
EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) ePrivacy Directive (edpb.europa.eu)
EDPB Guidelines 05/2020 on consent under Regulation 2016/679 (edpb.europa.eu)