What are cookies and how do they work?

Cookies are short pieces of text sent from a website to a browser that record information about the user. The browser stores the cookie and sends it back to the site on later visits, which is how a site remembers you are logged in, what is in your cart, or which language you chose. Each cookie is small, typically capped at around 4KB (4,096 bytes), but a single site can set dozens of them.

What are cookies used for?

Cookies serve several purposes:

• Functionality: remembering logins, cart contents, and preferences.
• Security: helping detect fraudulent activity and protect accounts.
• Analytics: measuring how people use the site, such as pages visited and time on page.
• Advertising: enabling targeted ads and measuring campaigns.
• Personalization: tailoring content to a returning visitor.

The analytics and advertising uses are where compliance risk concentrates, because those cookies often involve third parties and personal data.

The three ways cookies are classified

First-party vs third-party cookies

First-party cookies are set by the site you are visiting. Third-party cookies are set by another domain, usually an advertiser or analytics provider whose script runs on the page. Third-party cookies raise the most privacy concern, because they enable tracking a person across multiple sites.

Essential vs non-essential cookies

Essential (or strictly necessary) cookies are required for the site to function, like keeping you logged in or holding a cart. Non-essential cookies cover analytics, advertising, and personalization. The distinction matters legally: EU and UK cookie rules let essential cookies run without consent but require consent before non-essential ones fire.

Session vs persistent cookies

Session cookies last only until you close the browser. Persistent cookies stay for a set period, from days to years, and are what let a site recognize you on a return visit. Persistent tracking cookies raise the most privacy concern because of how long they follow a person.

What is a cookie audit?

A cookie audit is a process by which website owners can ensure cookies are effective and legally compliant. It answers three questions: which cookies does the site set, what does each one do and where does it send data, and is each one allowed to run under the consent the visitor gave. You can run an audit automatically with a tool or manually by hand, and most teams use a mix.

How to conduct an automatic cookie audit

An automatic audit uses a tool to load your site and record every cookie that appears, which is faster and more complete than checking by hand. A good automatic audit covers three things:

How to conduct a manual cookie audit

A manual audit is slower but useful for spot checks and for understanding what a tool reports. These six steps work either way.

1. 1

   Step 1: Identify cookies

   List every cookie the site sets, using your browser’s developer tools or an audit tool. Record the name, domain, and expiry of each.

2. 2

   Step 2: Conduct a cookie review and analysis

   For each cookie, determine what it does, who set it, and what data it holds or transmits. This is where third-party cookies reveal themselves.

3. 3

   Step 3: Categorise cookies

   Sort each cookie into essential or non-essential, and note whether it is first-party or third-party and session or persistent. This categorization drives your consent requirements.

4. 4

   Step 4: Ensure compliance

   Check each non-essential cookie against the consent rules that apply to your visitors. Confirm nothing non-essential fires before consent, and that declining consent actually stops it.

5. 5

   Step 5: Create a cookie policy

   Publish a cookie policy that lists the cookies you set, their purpose, and their duration, and keep it matched to what the site actually does.

6. 6

   Step 6: Implement a long-term cookie management strategy

   Cookies change as your site and its vendors change. Schedule recurring audits and monitor for new cookies, so your inventory and policy stay accurate rather than drifting out of date.

Automatic cookie audit vs manual cookie audit

A manual audit is fine for a small, stable site or a one-time check, but it is slow and easy to get wrong, because it captures only the cookies present at the moment you look. An automatic audit runs continuously, catches cookies that appear only after an interaction, and can validate consent state, which manual checking cannot do reliably. Automatic auditing is the reliable standing control, and manual checks are useful for investigating specific findings.

The check most cookie audits skip

Listing your cookies is the easy part. The harder question is whether those cookies actually honor consent: does a consent management platform record a visitor’s choice, and do the tags and cookies then follow it? A platform records the decision, but confirming the cookies obey it is a separate check that a static cookie inventory does not perform. See how consent verification works, and how DataTrue and OneTrust compare.

DataTrue automates the audit and the consent check together: it loads your site the way a real visitor would, records every cookie and tag, confirms nothing non-essential fires before consent, and gives you a timestamped record you can show a regulator.