Cookie scanner

The cookie scanner crawls your site with a real headless browser (Playwright) and records every cookie it observes, so your cookie declaration table stays accurate without you maintaining it by hand.

How it works

1. The scanner loads your site's homepage (https://yourdomain.com/) in a headless Chromium instance.

2. Every cookie set during that visit is captured and run through the categorization engine, then saved as a snapshot for your property.

3. The declaration table and the public /api/v1/:cbid/cookies feed always serve the latest snapshot.

Note: Scanning only sees cookies that are set on the pages it visits. Cookies that only fire after a specific user interaction (e.g. clicking a video embed) may need to be added manually or picked up by live observation (below).

Categorization

Each cookie is matched against a curated provider database in three tiers, in order of confidence:

Each match resolves a category (Necessary, Preferences, Statistics, Marketing), a provider, a purpose description, and an expiry. Cookies that don't match anything land in the Unclassified category, flagged so you can review and reclassify them.

Running a scan

From Dashboard → Cookies, click Scan now. The scan runs asynchronously:

• The button shows a scanning state while a crawl is in flight for that property.

• A second scan request for the same site while one is already running returns "already scanning" rather than starting a duplicate crawl.

• Once complete, the table refreshes automatically and a Scanned on badge shows the last-crawl date.

Note: Rescanning is safe to run as often as you like — each crawl fully replaces the previous snapshot for that property.

Live observation

Independent of scheduled/manual crawls, the embed script can report cookie names (never values) it sees on real visitor page loads back to the API. These observations are merged into the latest snapshot — known classifications are preserved, and newly seen cookie names are categorized and added. This catches cookies that only appear under real traffic patterns the crawler didn't trigger.

Automatic rescanning

Operators can enable a scheduled daily crawl across all verified properties, plus a weekly diff report that flags newly appeared or disappeared cookies since the last report — useful for catching a marketing team quietly adding a new ad pixel.

Needs review

The page header shows a Needs review badge whenever any cookies are still Unclassified. Search and filter the table by category or provider to find them, then correct the category from the cookie declaration view.

See also: Cookie declaration table · Vendors & ROPA for tracking the vendors behind these cookies.