Want to check what cookies your website uses? The simplest and most reliable tool for checking what cookies a website uses is simply your browser.
To check what cookies a site sets and whether its consent management system works correctly, do the following:
- First, close all browser tabs.
- Clear your browsing data (in particular cookies and other site data — in Chrome > Clear browsing data — with the “All time” option). This way your next visit to your site will be the visit of a user who hasn’t given consent yet.
- Now open a browser tab and go to Developer Tools. In Chrome you’ll find them under View > Developer.
- In Developer Tools, open the Application > Cookies tab.
- Now visit your site. A consent prompt should appear on the page. Don’t respond to it yet (don’t accept or reject anything in the cookie banner).
- Check what cookies have appeared. These should only be files necessary for the site to work — e.g. ones that remember the language settings, handle the shopping cart, take care of site security, and so on. In particular, cookies such as _ga (Google Analytics), _uetsid (Bing Ads), _fbp (Meta), _ttp (TikTok) etc. should NOT be there. If you don’t know what a given cookie does, you can look it up at cookiedatabase.org. When in doubt, talk to your site’s developer.
- Give consent in your site’s CMP and check what the cookies look like now — more of them should appear. This means the tracking functions were only activated after consent.
It’s also worth checking the information stored in the Local storage and Session storage registers on the Application tab. These are the so-called “other cookie-like technologies”, whose use may also require consent.
You can also repeat the whole procedure from the start and check how the site behaves when consent is refused (it should look the same as before consent was given; an additional cookie with the consent status (denied) may be saved if it wasn’t there before).
It is very important to run the test in a browser (profile) with no other pages open, cleared before the test as described above.
Otherwise, the developer tools may show the site’s previously saved cookies, which may already be out of date. You may also see 3rd party cookies left by other sites browsed earlier in that browser which use scripts from the same 3rd party domains as the site being tested.
This is still a long way from a full compliance audit, but it lets you check whether consent management has actually been configured and isn’t just a mock-up that ignores the user’s consent or refusal.
See also: How to check whether Google consent mode is working.
