Cookies on a website are small text files that the site, or a script it loads, stores in the visitor's browser. To find the ones your website uses, check four places: your browser's developer tools, an automated cookie scanner, the Set-Cookie headers in the Network panel, and local storage and session storage. Each shows a different part of the picture, and together they give you a full inventory.
Most website owners know they set cookies. Far fewer know exactly which cookies, from which vendors, for which purposes and for how long. Under Article 5(3) of the ePrivacy Directive, storing or accessing information on a visitor's device requires prior informed consent unless it is strictly necessary to deliver a service the visitor explicitly requested. The GDPR then defines what valid consent means: freely given, specific, informed and unambiguous. You cannot meet either standard if you do not know what your site sets in the first place.
A cookie inventory is what regulators ask for first
Regulators are not interested in vague assurances. According to the CNIL's review of its 2025 actions, France's data protection authority imposed 83 sanctions totalling €486,839,500 that year, and 21 organisations were sanctioned over cookies and other trackers. Among the largest, Shein was fined €150 million in September 2025 for advertising cookies set before any choice, and Google €325 million the same day for ads inserted between Gmail emails and for cookies set at account creation without valid consent. In cases like these, the organisation either did not know which cookies fired on page load or had not tied them to the visitor's choice.
Knowing your cookies is the first step toward a defensible position. The list also feeds your cookie policy, your consent banner configuration and the categories visitors see.
Method 1: check cookies on any website in Chrome, Firefox and Safari
Every modern browser includes developer tools that let you view the cookies on any page. This method costs nothing and gives you a real-time snapshot of what is active on a given URL.
Google Chrome
Open your site in an Incognito window (Ctrl+Shift+N on Windows, Cmd+Shift+N on Mac) so you start with a clean slate. Right-click anywhere on the page and select Inspect, then open the Application tab. In the left sidebar, expand Storage and select Cookies. Each row shows the cookie name, value, domain, path, expiry, size and flags like Secure, HttpOnly and SameSite. For a longer walkthrough of every column, see the guide to auditing cookies in Chrome DevTools.
Read the Domain column carefully. Cookies listed under your own domain are first-party cookies, and that includes _ga and _fbp, which the Google Analytics and Meta Pixel scripts write on your domain. They are still tracking cookies that need consent. Cookies under other domains, such as IDE on .doubleclick.net or fr on .facebook.com, are third-party cookies.
How to read the Domain column in Chrome
_ga is first-party and still an analytics cookie that waits for consent.The expiry column has a ceiling of its own. Since Chrome 104 (August 2022), a cookie cannot be set to expire more than 400 days in the future, so Chrome shows a shorter lifetime than the 2 years Google Analytics asks for.
Firefox
Open a private window, go to your site and press F12 to open the developer tools. Select the Storage tab, then Cookies. Firefox shows the same fields as Chrome: name, domain, path, expiry and attributes. Its Enhanced Tracking Protection blocks many known trackers by default, so some third-party cookies you see in Chrome will not appear here at all.
Safari
In Safari, cookies are stored in Web Inspector under Storage > Cookies. To get there, turn on the developer features first: choose Safari > Settings, select Advanced, then select "Show features for web developers". Open your site in a private window, choose Develop > Show Web Inspector, select the Storage tab and then Cookies. Safari's Intelligent Tracking Prevention (ITP) caps the expiry of cookies set by JavaScript at seven days, so the values you see here may differ from Chrome.
What a manual check misses
Developer tools only show cookies for the page you are viewing. Cookies that fire on other pages, such as the checkout, a login form or an embedded video, will not appear unless you visit those pages one by one. A manual check also misses cookies that load only after an interaction, such as opening a chat widget or accepting a consent prompt.
Method 2: use an automated cookie scanner
An automated cookie scanner crawls the pages of your site in a real browser, runs their JavaScript and records the cookies it encounters. Most scanners also suggest a category for each one: necessary, functional, analytics or marketing.
Kukie.io's free cookie scanner works as a cookie checker for any URL. Enter your address and it crawls the site, lists the cookies it finds on the pages it reaches with their domain and duration, and matches them against a database of known cookies to suggest a category. It also reads local storage and session storage.
A scanner is faster and more thorough than a manual check because it follows internal links across many pages. It also records cookies set by third-party scripts such as ad pixels, social embeds and analytics tags that nobody remembers installing. It finds only what loads on the pages it reaches, so pages behind a login or a form may still need a manual check.
Method 3: inspect HTTP headers and network requests
For a deeper technical view, open Chrome DevTools and switch to the Network tab before loading the page. Reload your site and look at the Set-Cookie headers in each response. This shows exactly when a cookie is created during the page load, and whether that happens before or after the visitor's choice.
| Attribute | What it tells you | Why it matters |
|---|---|---|
Domain | Which domain the cookie belongs to | Distinguishes first-party from third-party cookies |
Expires / Max-Age | When the cookie expires | Belongs in your cookie policy. Whether consent is needed depends on the cookie's purpose, not its lifespan |
SameSite | Cross-site sending behaviour | Affects whether the cookie works across domains. None requires Secure |
HttpOnly | Not accessible to JavaScript | These cookies do not appear in document.cookie |
Secure | Only sent over HTTPS | Good security practice, and required when SameSite=None |
To list only the responses that set cookies, type has-response-header:set-cookie into the Network filter box, a filter described in Chrome's Network features reference. If a _ga or _fbp cookie appears before the visitor has made any choice, the site is setting tracking cookies without consent, which is what the ePrivacy Directive rules out.
Method 4: audit local storage and session storage
Cookies are not the only storage that privacy law covers. The EDPB Guidelines 2/2023 on the technical scope of Article 5(3), adopted in final form on 7 October 2024, confirm that the rule applies to any storage of or access to information on a visitor's device. That brings local storage, session storage and IndexedDB into scope. In Chrome DevTools they appear under Application > Storage next to cookies. If a marketing script writes a unique identifier into localStorage instead of a cookie, that identifier still needs consent.
What to record in your cookie inventory
Once you have found your cookies, document each one. A complete inventory includes the cookie name, the domain that sets it, its purpose, its duration (session or persistent, and the exact expiry if persistent), its category (necessary, functional, analytics or marketing) and the third-party vendor responsible, if any. For an unfamiliar name, look the cookie up in the Cookie database.
This inventory feeds three outputs that regulators expect to see:
Your cookie policy, listing every cookie with its purpose and duration
Your consent banner, grouping cookies into categories so visitors can make informed choices
Your records of processing activities under GDPR Article 30, where cookie-based tracking involves personal data
How often to scan
A cookie inventory is not a one-off task. New cookies appear whenever a developer adds a script, a plugin updates or a marketing team installs a new tracking pixel. The CNIL's enforcement record shows that a list made once and never checked again does not hold up.
For most sites, a monthly scan is a sensible baseline. E-commerce sites running frequent campaigns or A/B tests should scan weekly. If your consent management platform offers scheduled scans, turn them on: they catch new cookies before a visitor or a regulator does.
Common surprises when you first scan
Most site owners discover more cookies than expected on their first scan, and third-party embeds are the usual cause. A YouTube video, a Google Maps widget or a social sharing button each brings cookies of its own. The privacy-enhanced YouTube embed (youtube-nocookie.com) changes how Google says it uses views, but it does not by itself remove the need for consent.
Tag managers add another layer. If Google Tag Manager loads all tags before consent is collected, every tag's cookies fire immediately: analytics, remarketing, heatmaps. Configuring the tag manager to wait for consent signals, through Google Consent Mode v2 or consent-based triggers, stops that pre-consent loading, the same pattern behind the Shein fine.
Questions about finding your website's cookies
How can I check cookies on a specific page without any tools?
Open the page in a private or incognito window, right-click, select Inspect and open Application (Chrome) or Storage (Firefox). Under Cookies you will see every cookie active on that page, with its domain, expiry and attributes.
Where are cookies stored in Safari's Web Inspector?
In Web Inspector, open the Storage tab and select Cookies. If the Develop menu is missing, choose Safari, then Settings, select Advanced and turn on Show features for web developers.
Do I need to list cookies in my cookie policy even if they are set by third parties?
Yes. Under the GDPR and the ePrivacy Directive, you answer for the cookies placed on your visitors' devices through your site, whichever script sets them. Regulators expect your cookie policy to give each cookie's name, purpose, provider and duration.
How often should I run a cookie scan on my website?
At least once a month. Sites with frequent changes to scripts, plugins or marketing campaigns should scan weekly. Scheduled scans are the most reliable way to keep to that rhythm.
Can local storage and session storage trigger the same consent requirements as cookies?
Yes. The EDPB's Guidelines 2/2023, adopted in October 2024, confirm that Article 5(3) of the ePrivacy Directive covers any storage of or access to information on a visitor's device. Local storage, session storage and IndexedDB need consent when used for analytics or advertising.
Why do I see different cookies in Chrome, Firefox and Safari?
Safari and Firefox block most third-party cookies by default through Intelligent Tracking Prevention and Enhanced Tracking Protection. Chrome still allows them unless the user turns them off. A full cookie audit should use Chrome, or a scanner built on Chromium, to see every cookie your site tries to set.
See every cookie your pages set before visitors do
If you have never checked what cookies your site sets, an automated scan is the fastest way to get a clear picture. The free scanner lists the cookies it finds on the pages it crawls, with a suggested category and duration, ready for your policy and your banner.
