The first step of cookie compliance is knowing which cookies run on your site. It sounds simple; but modern websites run dozens of third-party cookies their owners are not even aware of. A cookie scan removes exactly this invisibility and gives you a solid foundation on which to build the rest of your compliance.
What Is a Cookie Scan?
A cookie scan is when a tool visits your site like a real browser and detects all cookies and trackers that load. The result: first/third-party distinction, cookie categories, durations, and which domain set which cookie. A good scan crawls not only the homepage but different templates (product, blog, contact form, checkout step) so it also captures cookies that fire only on specific pages.
What Is a Cookie and Why Does It Matter?
A cookie is a small text file stored in your browser; it is used for session management, remembering preferences, analytics measurement or ad targeting. The critical distinction for KVKK is this: necessary (strictly required) cookies do not need consent, whereas non-essential cookies such as analytics and marketing require the user's consent before they start running. Classifying cookies correctly is therefore a precondition for a compliant consent banner.
Why Can't You Know on Your Own?
- Third-party cookies: Ad networks, embedded videos, social buttons and analytics tools set their own cookies.
- Chained loading: One script loads other scripts; each can add new cookies.
- Dynamic content: Campaign tags, A/B tests and plugins change over time.
That is why a site claiming "we only use Google Analytics" finds far more trackers in a scan. Often a conversion pixel added by the marketing team, or a video embedded by the content team, brings in new cookies without the IT team's knowledge.
What Does a Scan Reveal?
| Field | What you learn |
|---|---|
| Party | First- or third-party |
| Category | Necessary / functional / analytics / marketing |
| Duration | Session or persistent; how long |
| Source domain | The service that set the cookie |
How Does Scanning Support Compliance?
- Correct categorisation: You can offer the right consent categories on the banner.
- Prior blocking: You can block non-essential cookies until consent.
- Cookie policy: The basis for a current, complete cookie policy.
- Evidence: Proof in an audit that "we know what runs and manage it".
The Post-Scan Workflow
A scan alone does not make you compliant; the real value is in how the output is used. A recommended sequence:
- Categorise the cookies and investigate uncertain ones (e.g. an unfamiliar third party).
- Block non-essential cookies so they do not run until consent is given (prior blocking).
- Map the consent banner to these categories; offer a "reject" option as visible as "accept".
- Update your cookie policy with the scan output and record consents given/withdrawn.
How Often Should You Scan?
New cookies can appear whenever the site changes. Best practice: regular (e.g. monthly/quarterly) automated scanning plus a one-off scan after every major release. A new marketing campaign, a third-party integration or a theme update is also a good trigger for an extra scan.
Example Scenario: The "Only Analytics" Fallacy
An SME believed it used only Google Analytics. A scan revealed that an embedded YouTube video, a social-media pixel and a live-chat tool set 12 more cookies in total. Most were in the marketing/analytics category and ran before consent — meaning the current banner was not compliant. Based on the scan output, the organisation put these cookies behind prior blocking, made its banner category-based, and aligned its cookie policy with reality. The result: an honest choice for the user and a record that can be shown in an audit.
Understanding Cookie Categories
What makes a scan's output meaningful is placing cookies in the right categories. In practice four main categories are used:
- Necessary (strictly required): Cookies essential for the site to work, such as session, security, load balancing and cart. No consent needed.
- Functional: Cookies that improve the experience, such as language preference, region or theme choice. Usually subject to consent.
- Analytics/performance: Cookies that measure visitor behaviour (e.g. page views, clicks). Must not run before consent.
- Marketing/targeting: Cookies used by ad networks and social pixels that can track a person across sites. These are the most sensitive and always require consent.
Miscategorisation is as risky for compliance as skipping the scan itself: labelling a marketing cookie as "necessary" effectively removes the user's right to choose.
Is a Manual Check Enough?
Some teams try to assess the situation by looking at the "Application > Cookies" tab in the browser's developer tools. This gives a quick idea but is misleading: it shows only the cookies that fire at that moment on that single page you visited, and misses trackers loaded later on other templates or through user interaction (e.g. playing a video, clicking a form). An automated scan, by contrast, systematically crawls the site to close these gaps and turns the result into a reportable, repeatable record. In an audit, saying "we checked by hand" is quite weak next to "we scan regularly and document it".
Frequently Asked Questions
Are a cookie scan and a cookie policy the same thing?
No. A scan detects which cookies exist; a cookie policy is the text that explains them to users. The policy is based on the scan's output, and it should be updated whenever the scan is updated.
Is a one-off scan enough?
No. New cookies are added as the site changes; periodic scanning is essential. A single snapshot may no longer reflect reality a few months later.
What should I do after a scan?
Categorise the cookies, set up prior blocking, update your cookie policy, and keep consent records. In other words, treat the scan as a starting point, not a finish line.
Do I also need consent for necessary cookies?
No. Strictly necessary cookies (e.g. session, security, cart) are required for the service to work and do not need consent. The consent requirement applies to non-essential cookies such as analytics and marketing — and to draw that line correctly, you need a scan.
This content is for general information only and does not constitute legal advice. With JUS. you can scan your site for **free**, see all cookies with their categories, and set up KVKK-compliant consent management.