Imagine: 200+ pages in production, each with Google Analytics, Facebook Pixel, Hotjar, Intercom, and a dozen widgets. Manual cookie collection takes a week, and you have to repeat after every update. Once we found 17 unaccounted cookies from a misconfigured YouTube iframe — the client had no idea. Automation solves this in half a day.
A cookie scanner works like this: it loads the site in a browser emulator, simulates clicks, and collects all cookies set during load and interaction. Then each cookie is matched against a database of known services (5000+ records). The result is a complete list with categories: necessary, analytics, marketing. This isn't just inventory — it's the foundation for a correct consent banner. Our experience shows: automated scanning covers up to 98% of all cookies, leaving only 2% for manual review — ensuring no fines.
Cookiebot vs CookieYes: comparison
| Feature | Cookiebot | CookieYes |
|---|---|---|
| Automatic blocking | data-blockingmode="auto" |
Built-in |
| TCF support | Full | None |
| GA4/GTM integration | Deep | Basic |
| Discoverable cookies | 5000+ | 2000+ |
| Free trial | 30 days | Unlimited (limited) |
Cookiebot is chosen for high-privacy projects — full TCF support and deep Google integration. CookieYes suits small websites: easier to set up and cheaper. We use Cookiebot in 80% of projects.
How a cookie scanner helps avoid fines?
Non-compliance with GDPR can cost up to €20 million or 4% of annual global turnover. The scanner automatically classifies cookies and passes data to the CMP, enabling correct consent requests. Without a scanner, you risk missing cookies from hidden scripts — e.g., those loaded after a click on widgets. In one project, we found 17 extra cookies from a YouTube iframe that the client had ignored for years. Time savings — up to 80%, confidence in protection — 100%.
Setting up Cookiebot: step by step
-
Script installation — insert into
<head>before all other scripts (critical for blocking):
<script id="Cookiebot" src="https://consent.cookiebot.com/uc.js" data-cbid="YOUR_CBID" data-blockingmode="auto" type="text/javascript"> </script> - Script marking — for each non-essential script, set
type="text/plain"anddata-cookieconsent="statistics"(or marketing, preferences). Example:
<script type="text/plain" data-cookieconsent="statistics"> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-XXXXXXXX'); </script> - Verification — reload the page, open the banner, and give consent. Ensure scripts load only after consent. Use DevTools → Network to verify.
Why automated scanning beats manual?
Manual collection via DevTools gives a snapshot of a single session. You don't see cookies from services that load only after a click — e.g., video player or chat. Automation traverses all pages, simulates interactions, and delivers a full report. In one project we found 17 extra cookies — the client didn't even know. Time savings — up to 80%.
What other tasks does the scanner solve?
Beyond inventory, the scanner integrates with CMP (Consent Management Platform). It passes cookie categories to the banner so users can choose what to consent to. Without a scanner, classification is done manually — a common mistake leading to fines. According to GDPR.eu, non-compliance can cost up to €20 million or 4% of annual turnover. Our team is certified in GDPR compliance and has experience on 50+ projects — we guarantee correct setup.
Typical setup mistakes
| Mistake | Consequence | Solution |
|---|---|---|
Scanner script at end of <body> |
Blocking fails | Move to <head> |
Wrong data-blockingmode |
Scripts load before consent | Use auto |
| Not marking deferred-load scripts | GTM sets cookies without consent | Add data-cookieconsent |
| Not checking after updates | New plugin sets cookies | Regular scanning |
After setup, you receive a CSV file with: domain, cookie name, category, expiration, description. We also provide an updated Cookie Policy in HTML, ready for publication.
What's included in turnkey setup?
- Installation and configuration of the chosen scanner (Cookiebot/CookieYes).
- Marking all existing scripts (analytics, ads, social).
- Verification of blocking and unblocking via consent.
- Manual cookie audit + Playwright automation for full coverage.
- Delivery of report and updated Cookie Policy.
- Instructions for adding new scripts.
Timelines and how to order
Basic setup — 0.5–1 business day. If 10+ services integration or design customization needed — up to 3 days. Contact us for a free site audit. Get a consultation on scanner selection and legal protection. Order turnkey setup — and forget about cookie issues.