cookie-audit

Auditing Website Cookies and Trackers

Overview

A cookie audit is the foundational step in achieving cookie consent compliance. It involves systematically identifying, categorizing, and documenting every cookie and tracking technology deployed on a website. The Court of Justice of the European Union in Planet49 GmbH v. Bundesverband der Verbraucherzentralen (Case C-673/17, 1 October 2019) established that pre-ticked checkboxes do not constitute valid consent under the ePrivacy Directive, and that users must be informed about cookie duration and third-party access before consenting. A thorough audit reveals what consent must be obtained and what disclosures must be made.

Audit Methodology

Phase 1: Preparation

Before scanning, document the audit scope for Pinnacle E-Commerce Ltd:

Parameter	Value
Primary domain	www.pinnacle-ecommerce.com
Subdomains in scope	shop.pinnacle-ecommerce.com, account.pinnacle-ecommerce.com, blog.pinnacle-ecommerce.com
Authenticated pages	Yes — customer account, checkout flow
Mobile-specific pages	m.pinnacle-ecommerce.com
Third-party integrations	Google Analytics 4, Meta Pixel, Hotjar, Stripe, Intercom
Scan frequency	Quarterly (next: Q2 2026)

Phase 2: Automated Scanning

Deploy scanning tools to capture all cookies and tracking technologies:

Browser-Based Scanning

Use a headless Chromium instance to crawl the site and capture:

• First-party cookies set via Set-Cookie headers
• First-party cookies set via document.cookie JavaScript API
• Third-party cookies from embedded resources
• LocalStorage and SessionStorage entries
• IndexedDB databases
• Pixels and beacons (1x1 image requests, navigator.sendBeacon() calls)
• Browser fingerprinting scripts (canvas, WebGL, AudioContext)

Network-Level Capture

Monitor HTTP/HTTPS traffic to identify:

• Tracking parameters in URL query strings (utm_*, fbclid, gclid)
• Redirect chains through tracking domains
• Cookie syncing between third parties
• Server-to-server data sharing endpoints

Phase 3: Cookie Categorization

Classify each cookie using the ICC UK Cookie Guide categories, aligned with the ePrivacy Directive Article 5(3):

Category 1: Strictly Necessary Cookies essential for the website to function. No consent required under Article 5(3) exemption.

Examples for Pinnacle E-Commerce Ltd:

Cookie Name	Domain	Duration	Purpose
session_id	.pinnacle-ecommerce.com	Session	Maintains user session state
csrf_token	.pinnacle-ecommerce.com	Session	Cross-site request forgery protection
cart_items	shop.pinnacle-ecommerce.com	24 hours	Shopping cart contents
auth_token	account.pinnacle-ecommerce.com	30 minutes	Authentication state
load_balancer	.pinnacle-ecommerce.com	Session	Server load distribution

Category 2: Performance/Analytics Cookies that collect aggregate usage data. Consent required.

Cookie Name	Domain	Duration	Purpose
_ga	.pinnacle-ecommerce.com	2 years	Google Analytics client ID
_ga_XXXXXXX	.pinnacle-ecommerce.com	2 years	GA4 session persistence
_gid	.pinnacle-ecommerce.com	24 hours	GA4 session distinction
hjSessionUser*	.pinnacle-ecommerce.com	1 year	Hotjar user identification
hjSession*	.pinnacle-ecommerce.com	30 minutes	Hotjar session data

Category 3: Functionality Cookies that remember user preferences. Consent required unless strictly necessary.

Cookie Name	Domain	Duration	Purpose
locale	.pinnacle-ecommerce.com	1 year	Language preference
currency	shop.pinnacle-ecommerce.com	1 year	Currency selection
recently_viewed	shop.pinnacle-ecommerce.com	30 days	Recently viewed products

Category 4: Targeting/Advertising Cookies used for ad targeting and cross-site tracking. Consent always required.

Cookie Name	Domain	Duration	Purpose
_fbp	.pinnacle-ecommerce.com	90 days	Meta Pixel browser ID
_fbc	.pinnacle-ecommerce.com	90 days	Meta click identifier
_gcl_au	.pinnacle-ecommerce.com	90 days	Google Ads conversion linker
IDE	.doubleclick.net	13 months	Google ad serving
fr	.facebook.com	90 days	Meta ad delivery and measurement

Phase 4: Gap Analysis

For each cookie identified, verify against Planet49 requirements:

Planet49 Compliance Checklist:

1. Active consent mechanism: Is consent collected via affirmative action (click, toggle), not pre-ticked boxes? (Planet49, para. 62)
2. Pre-consent information: Before consent is given, is the user informed of:
   • Cookie duration? (Planet49, para. 81)
   • Whether third parties have access? (Planet49, para. 81)
   • The specific purpose of each cookie category?
3. Granularity: Can users consent to cookie categories individually, not just accept all?
4. No cookie walls: Is site access available without consenting to non-essential cookies?
5. Withdrawal mechanism: Can users withdraw consent as easily as they gave it?

Gap Analysis Template:

Cookie	Category	Consent Collected	Duration Disclosed	Third-Party Disclosed	Gap
_ga	Analytics	Yes	No — listed as "persistent" not "2 years"	No — Google not named	Duration + third-party disclosure
_fbp	Targeting	Yes	Yes	Yes	None
locale	Functionality	No	No	N/A	Assess if strictly necessary

Phase 5: Reporting

The audit report for Pinnacle E-Commerce Ltd must include:

1. Executive summary: Total cookies found, breakdown by category, critical gaps
2. Complete cookie inventory: Full table with name, domain, duration, purpose, category, legal basis
3. Third-party tracker inventory: All third-party domains receiving data, with data types shared
4. Compliance gap register: Each gap, severity (high/medium/low), remediation recommendation
5. Cookie policy update recommendations: Specific text changes needed
6. Consent mechanism assessment: Whether current banner meets Planet49 requirements
7. Recommended scan schedule: Quarterly for production, on-demand for new feature deployments

Ongoing Monitoring

Schedule automated scans to detect new cookies introduced by:

• Developer deployments (new analytics or marketing tags)
• Third-party script updates (vendor SDK updates adding new cookies)
• A/B testing platforms adding experiment cookies
• CDN or infrastructure changes

Integrate cookie scanning into the CI/CD pipeline: any new cookie detected in staging must be categorized and documented before deployment to production.

Key Legal References

• CJEU Case C-673/17 (Planet49) — Active consent required; pre-ticked boxes invalid; cookie duration and third-party access must be disclosed before consent
• ePrivacy Directive 2002/58/EC, Article 5(3) — Consent required for storing/accessing information on user devices, with strictly necessary exemption
• GDPR Article 4(11) — Definition of consent: freely given, specific, informed, unambiguous indication
• EDPB Guidelines 05/2020 on Consent — Detailed guidance on valid consent mechanisms
• ICC UK Cookie Guide (2012) — Cookie categorization framework (strictly necessary, performance, functionality, targeting)
• CNIL Deliberation No. 2020-091 (17 September 2020) — Guidelines on cookies and other trackers