How to audit your website's cookies and trackers (and keep the list current)

To audit your website's trackers, open your pages in a real browser with scripts running, record every cookie, storage key, pixel and third-party request, once before accepting your cookie banner and once after, then work out who each belongs to and why it's there. Repeat it whenever the site changes.

1. Start with a clean browser

Use a private window or a fresh browser profile, so nothing from earlier visits is already stored. You want to see what a first-time visitor's browser receives.

2. Record before you click anything

Open your homepage and, without touching the cookie banner, look at the browser's developer tools:

• Network: every request to a domain that isn't yours is a third party learning that someone visited.
• Application → Cookies: name, domain, expiry and whether it's your domain or someone else's.
• Application → Local and session storage: scripts often keep identifiers here instead of cookies.

Anything for analytics, advertising or marketing that appears at this point loaded before the visitor chose. Note it.

3. Accept the banner and record again

Press "Accept all" and reload. Compare: what appeared only after consent, and did anything from step 2 disappear when it should have been blocked?

4. Visit more than the homepage

Product pages, checkout, blog posts and contact forms often load different tools (reviews, chat, maps, video). Check a sample of each page type, or crawl the site.

5. Name every vendor and purpose

For each domain, cookie and storage key, find the company behind it, what it's for (strictly necessary, functional, analytics, advertising, marketing) and its privacy policy. Mark anything you can't identify and find out who added it.

6. Turn it into a table you maintain

Keep one list with the item, vendor, purpose, duration and whether it's first or third party. That list feeds your cookie policy, your records of processing and your answers when someone asks what you collect.

7. Re-check on a schedule

Apps update, marketing adds a tag, a developer tests a new tool. Repeat the audit monthly, or weekly if your site changes often, and look at what changed since last time.

Where Privara fits

Privara does steps 2 to 7 for you. Its scanner visits your pages in a real browser, records requests, cookies, storage and pixels before and after accepting your banner, and names the vendor behind each from a curated catalog, flagging the rest. You review each item into an inventory, export a cookie table, and rescans show what changed. You can try it on your homepage without an account. Privara reports what a browser saw; it isn't legal advice.