Tools

Reading your cookie report

Every scan from the cookie scanner produces one report. This page explains each part of it, from the numbers at the top to the tables further down, so you know what every field is telling you and what it is not.

The scorecard

The report opens with four headline numbers. They are a quick read of the page, not a grade.

Cookies found. How many distinct cookies landed in the browser across the pages scanned, after accepting all.
Set before consent. How many of those cookies were already in the browser before the accept click. This is the number to watch, and it has its own deep dive.
Tracking technologies. How many known tracking tools the scanner identified, such as an analytics suite or an advertising pixel.
Serious findings. How many findings came back at the high severity level. Zero here is good. A number above zero points you at the findings table below.

Findings

Findings are the report's opinions, sorted by severity. Each one names a pattern, tells you why it matters, and points at what to do next. The set below is stable, but new findings get added over time as the tool learns to spot more patterns, so treat this as the current list rather than a fixed one.

Severity	Finding	What it means	What to do
High	Tracking cookies set before consent	Cookies used for analytics or advertising were in the browser before the visitor agreed to anything. Under many privacy laws this is the core problem.	Gate those trackers so they only fire after consent. See cookies set before consent.
High	Site served over plain http	The page loaded over `http` rather than `https`, so cookies and page data travel unencrypted.	Move the site to `https` and redirect `http` traffic to it.
Warning	Tracking identifiers written to storage before consent	An identifier was saved to `localStorage` or `sessionStorage` before consent. Storage is not a cookie, but a stored ID tracks a visitor the same way.	Hold identifier writes until after consent, the same as you would for cookies.
Warning / Info	Cookieless tracking identifiers in localStorage	The site stores identifiers in the browser instead of using cookies. Worth knowing, since it tracks visitors without a single cookie.	Confirm it is disclosed and consented like any other tracking.
Warning	Tracking cookies but no consent banner found	The scanner saw tracking cookies but could not find a consent banner to click.	Check whether a banner should be showing, or whether it is geo-targeted away from the scanner's region.
Warning / Info	Known advertising domains contacted	The page made requests to domains known for advertising or ad targeting.	Confirm each one is intended and covered by your consent flow.
Warning	Cookies persisting longer than 400 days	One or more cookies are set to live beyond 400 days, longer than several browsers and guidelines allow.	Shorten the cookie lifetime to a reasonable window.
Info	Third-party cookies without Secure and SameSite=None	A third-party cookie is missing the flags browsers expect for cross-site cookies, so it may be dropped or behave inconsistently.	Set `Secure` and `SameSite=None` on cross-site cookies, or reconsider whether the cookie is needed.

The cookie list

Below the findings is the full cookie list, one row per cookie. The columns:

Party. First party or third party. First party means the cookie's domain matches the site you scanned. Third party means it belongs to another domain the page loaded. The first-party vs third-party guide covers the distinction in full.
Category. One of functional, preferences, analytics, marketing, or unclassified. Unclassified means the cookie was not in the classification database, so the tool leaves it labeled rather than guess a purpose it cannot prove. It is a "we do not know", not a "this is fine".
Lifetime. How long the cookie is set to persist, from a single session to years.
Set before consent. A flag on any cookie that was already in the browser before the accept click. These are the rows to read first.
HttpOnly. When set, script on the page cannot read the cookie, which protects it from being stolen by injected code.
Secure. When set, the cookie is only sent over encrypted https connections, never plain http.
SameSite. Controls whether the cookie travels on cross-site requests. Strict and Lax keep it mostly on your own site, while None lets it ride along to other sites and is what third-party tracking cookies use.

Each row also shows the cookie name, its domain, its vendor when known, and its size.

Browser storage

Cookies are not the only way to track someone. The report has a separate section for localStorage and sessionStorage, classified with the same categories as cookies.

This section matters even when the cookie count is low. A site can set an identifier in localStorage and track a visitor across pages and visits with zero cookies involved. If the report shows a near-empty cookie list but a storage key that looks like a persistent ID, that is tracking, and it counts. A quiet cookie list is not the same as a quiet browser.

Tracking technologies

This section is the inventory of named tools the scanner recognized, such as Google Analytics 4, Meta Pixel, or Hotjar. Each entry lists the evidence that identified it, so nothing is a guess. Evidence can be any of:

Cookie names that match a known tool.
Storage keys the tool is known to write.
Request domains the tool calls out to.
Script URLs the page loaded.

Seeing the evidence lets you confirm a match and trace it back to whatever on your site is loading that tool.

Third-party domains

Here the report lists every third-party domain the pages contacted, with a request count for each and a flag on any that match a known tracker. A high request count to an unfamiliar domain is worth a look. A match against a known advertising or analytics network tells you a tool is phoning home, even if it set no cookie you recognized.

Scan notes

Finally, the report may carry scan notes: non-fatal things that happened during the crawl, such as a page timing out or a link the scanner chose not to follow. These do not fail the scan, but they explain gaps. If a page you expected to see is missing from the results, the notes usually say why. Read them before assuming the report is complete, and read them together with the blocked-scan guidance so an empty result is never mistaken for a clean one.