What a cookie scan finds – and what it misses
An automated crawl produces a list and with it a feeling of safety. Both can mislead: a scan sees only what happens during its own visit – and on most websites that is markedly less than what actually happens.
A scanner opens pages like a visitor, records which connections arise and what gets stored, and matches the findings against a catalogue of known services. As a first overview that is a good tool – for completeness it is an insufficient one.
How much a typical scan sees of a website
The five blind spots
- The logged-in area. A scanner does not log in. Yet that is exactly where the most personal processing sits.
- Event-driven scripts. Whatever loads only on submitting a form, playing a video or after thirty seconds is invisible to a crawl.
- Server-side forwarding. It leaves no trace in the browser and is in principle undetectable from outside.
- Regional differences. A scan from Frankfurt sees the European version. Advertising partners loaded only outside the EU stay invisible.
- Rotating advertising partners. With real-time auctions, who gets loaded is decided anew on each visit. Two crawls yield two different lists.
How to close the gaps
- Treat the scan as a starting point, not a result – and hold the findings against internal knowledge of which services are embedded.
- Walk through checkout and forms once by hand, with the network log open.
- Consult the list of contracts: every processing agreement names a service that is embedded somewhere.
- Review the published triggers in the tag manager – it states what loads when, more completely than any scan can observe.
A scan answers the question "what did I overlook". It does not answer the question "do I have everything".