How to find every cookie and tracker on your website (step by step)

By the Privacyboard teamPublished 29 October 2026Updated 4 November 20268 min read

Short answer

Open your site in a clean browser window, leave the banner untouched, and list the cookies, storage entries and third-party requests in DevTools. Repeat after Reject all and after Accept all. Then classify each item as strictly necessary or not, note its provider, purpose and duration, and repeat monthly.

You cannot ask for consent for trackers you do not know about. A cookie audit is the first step of any cookie banner setup: find everything your site stores or loads, work out what each item does, and write it down. You can do it with nothing but a browser, in under an hour for a small site.

This guide uses Chrome's developer tools. Firefox, Edge and Safari have equivalent panels with slightly different names.

#Why look beyond cookies?

The ePrivacy rule is not limited to cookies. Article 5(3) of the ePrivacy Directive covers any storage of information on a visitor's device, or access to information already stored there. The European Data Protection Board's Guidelines 2/2023 confirm that this includes tracking pixels, URL tracking and unique identifiers collected by scripts, and that the rule applies to "information", not only to personal data.

So your inventory should include:

Cookies, first-party and third-party.
Local storage and session storage, where scripts keep identifiers.
Tracking pixels and beacons, small requests that report a visit to another company.
Third-party requests, because loading a script or font from another company already shares the visitor's address with it.

#What you need before you start

A clean browser window: a private or incognito window, with no extensions that block ads or trackers, because blockers hide exactly what you want to see.
A list of your important pages: the home page, a blog or article page, a page with a video or map, the contact form, and the checkout or sign-up flow.
A spreadsheet to record what you find.

#Step by step

Open your home page in a private window. Do not click anything on the cookie banner yet. This is the "before choice" state, and it is the one regulators care about most.
Open the developer tools. Press F12, or Ctrl+Shift+I on Windows and Linux, or Cmd+Option+I on a Mac. Go to the Network tab, tick Preserve log and Disable cache, then reload the page. Disabling the cache approximates a first-time visit.
List the third parties. In the Network tab, open More filters and tick 3rd-party requests. Right-click the table header and enable the Domain column. Every domain that is not yours is a company receiving a visit.
List the cookies. Open the Application tab and go to Storage, then Cookies. Select each origin in turn. The table shows Name, Value, Domain, Path, Expires/Max-Age, Size, HttpOnly, Secure and SameSite.
List local and session storage. In the same Storage section, open Local storage and Session storage for each origin and note keys that look like identifiers.
Click Reject all, reload and compare. Clear the site's data first so you start clean. Anything still set or loaded after a refusal is a problem, unless it is strictly necessary.
Clear the data again, click Accept all, reload and compare. The difference between steps 6 and 7 is what your banner is supposed to control.
Repeat on the other pages. Embeds and widgets often appear on only one or two pages.

Record every item as you go. Do not try to classify while you collect.

#What to look for

Signal	Example	Where to see it
Third-party scripts	Analytics, advertising, chat or A/B testing tools	Network tab, Domain column
Tag managers	A container that loads other tags once it runs	A request to a tag manager domain, followed by new domains
Tracking pixels	A tiny image or `collect` request sent to an advertising or analytics company	Network tab, Img filter, small responses
Embedded video	YouTube or Vimeo players	Requests to the player's domain on the page
Embedded maps	Google Maps or similar	Requests to the map provider's domain
Social buttons and logins	Share buttons, "Sign in with" buttons	Requests to the social network's domain
Fonts and libraries	Web fonts or scripts from a content delivery network	Requests to a font or CDN domain
Storage entries	Keys such as client or visitor IDs	Application tab, Local storage

Check embeds in particular. Google describes YouTube's privacy-enhanced mode, which you enable by switching the embed domain to youtube-nocookie.com, as keeping views of the embedded video out of personalised browsing and showing non-personalised ads in the player. The player still loads content from Google, so confirm in the Network tab what your page really does.

Web fonts deserve a note: they set no cookie, so a cookie banner cannot ask about them, but loading them from another company still shares the visitor's address with that company. Hosting the fonts yourself avoids it.

Article 5(3) of the ePrivacy Directive requires consent for storing or reading information on a device, except where it is for the sole purpose of carrying out the transmission of a communication, or strictly necessary to provide a service the user has explicitly requested. Apply that test to each item, from the visitor's point of view and not yours.

The Article 29 Working Party (the EDPB's predecessor) explained the test in Opinion 04/2012. Two points help in practice: a cookie with several purposes is exempt only if every purpose is exempt, and necessity is judged by what the visitor asked for.

Category	Does it need consent?	Typical examples
Strictly necessary	No	Shopping basket, login session, security against repeated failed logins, load balancing, remembering the cookie choice itself
Preferences	Exempt only for a feature the visitor asked for, and generally for session or short-term cookies; longer retention needs consent	Language or display settings
Statistics (analytics)	Yes, except narrow cases	Visit counts, page views, session recording
Marketing	Yes	Advertising pixels, retargeting, social tracking

The Working Party considered session cookies for authentication exempt, but persistent "remember me" login cookies not exempt without consent. For analytics, the French authority CNIL accepts an exemption only for audience measurement that is strictly limited to the publisher's own use, produces anonymous statistics only, does not track users across sites and is not combined with other data or shared with third parties. Check the guidance of the authority in the countries you target before relying on it.

#How long do they last?

The Expires/Max-Age column tells you. A value of "Session" means the cookie is deleted when the browser closes. Anything else is persistent. The Working Party's opinion says the lifespan should match the purpose and expire once it is no longer needed. For audience measurement trackers that are exempt from consent, CNIL recommends a lifetime of 13 months that is not extended on later visits, and data retention of at most 25 months. It also describes keeping a visitor's consent or refusal for 6 months as good practice, not a legal requirement.

#How should I document them?

Create one row per item. This table becomes the base of your cookie policy and of the categories in your banner.

Name	Provider	Purpose	Category	Duration	Type
`_ga`	Google (Google Analytics)	Distinguishes visitors to produce statistics	Statistics	2 years (Google's cookie list)	First-party cookie
`[session cookie name]`	Your company	Keeps the visitor signed in	Strictly necessary	Session	First-party cookie
`[local storage key]`	[Provider]	[What it stores]	[Category]	[Persistent or session]	Local storage
`[request domain]`	[Provider]	[What it loads and why]	[Category]	Not applicable	Third-party request

Add the date of the check and the page where you found each item. When you cannot tell what an item does, look up the provider's documentation or ask them. An item with no known purpose should not stay on your site.

#Common surprises

A tag manager that loads more than you remember. Tags added years ago by an agency or a former colleague are still firing.
Embeds you forgot. A video in an old blog post or a map on the contact page.
Scripts that wait. Some trackers load only after a scroll, a click or a delay of a few seconds, so reload and wait before concluding the page is clean.
Trackers that run under the banner. The banner appears, but the scripts have already loaded. This is the most common failure.
Different behaviour by country. If your banner changes by region, test from the regions you serve.
Plugins and themes. A WordPress or website-builder update can add a script without any decision on your side.
Logged-in areas. Customer portals often use different tools from the public site.

#Can a tool do this for me?

A scanner saves time, but it should show you the same facts you would see by hand. Privacyboard's site scan opens your home page in a real browser three times (untouched, after Reject all and after Accept all) and reports which other websites the page contacted and which cookies were set in each case. It checks one page, so it is a spot check and not a full crawl. Once your banner is published it repeats the check about once a week and emails you when something new appears.

#How often should I repeat the check?

Monthly, as a routine, on your most visited pages.
After adding or changing a tool, such as analytics, a chat widget, an advertising pixel or a video embed.
After a redesign, a plugin or a theme update, or a change of hosting or CDN.
Before and after changing your banner, to confirm that blocking still works.

Update your cookie policy and privacy policy whenever the inventory changes. If you use Google tags, also check that Consent Mode follows the visitor's choice.

#FAQ

#How do I see all the cookies on my website?

Open DevTools, go to Application, then Storage, then Cookies, and select each origin. Also check the Network tab for third-party requests, because not every tracker uses a cookie.

Look at the Domain column. If it differs from your own domain, another company set it. The Network tab can also filter to show only third-party requests.

#Which cookies are strictly necessary?

Cookies without which the service the visitor explicitly requested cannot work, such as a login session, a shopping basket, load balancing or a security check. Analytics and advertising cookies do not qualify, even if they are useful to you.

#Do I need to check pages other than the home page?

Yes. Many embeds and widgets appear on a few pages only, such as a video on one article or a map on the contact page. Check the pages that matter most, and any page with an embed.

#Do tracking pixels and local storage count?

Yes. The ePrivacy rule covers any storage of or access to information on the visitor's device, and the EDPB has confirmed that tracking pixels and unique identifiers collected by scripts are within scope.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.