Cookie scan

The Cookie scan page lists the third-party cookies and embeds that Analytics found running on your site, matched to a vendor and a consent category, and flags any vendor you have not yet registered for consent gating. You read it from a site's Consent settings, on the Cookies tab. The scan is generated automatically by the consent script on your pages; there is no button to run it from this page.

How the scan runs

The scan happens in the visitor's browser, run by the consent script that loads on your pages. It reads the cookie names present in the browser, classifies each one against a list of known third-party patterns, and looks for cross-origin embeds on the page. The results are sent back to Analytics, stored against the site, and surfaced on this page.

The scan runs at most once per day. The script keeps a timestamp of its last scan and only scans again once 24 hours have passed, so the page reflects what was detected on the most recent qualifying page load, not the live state of your site. The summary line shows a Last scanned date and time, followed by a count of cookies and embeds detected.

Reading the two tables

Detected items are split into two tables. The 3rd-party cookies table covers cookies present in the visitor's browser; the 3rd-party embeds table covers cross-origin content loaded into your pages, meaning any <iframe> whose host differs from your site's host. A table only appears when that scan found at least one item of that kind.

The cookies table has four columns: Cookie (the cookie name, shown in monospace), Vendor, Category, and Status. The embeds table uses the same columns but leads with Host (the embed's hostname) instead of Cookie.

Vendor and category

Analytics matches each cookie name and each embed host against a built-in registry of known tools (Google Analytics, Meta Pixel, LinkedIn Insight, HubSpot, Hotjar, Intercom, and others). When a match is found, the Vendor column names the tool and the Category column shows the consent category it falls under: analytics, marketing, or personalization.

When no vendor is recognized, the Vendor column is left blank and the Category column shows an Uncategorized badge. For an unrecognized cookie, the scanner's own best-guess category is shown if it reported one; otherwise the row reads as uncategorized for you to review by hand.

The Status column

The Status column ties each detected vendor back to your script catalog, the list of third-party scripts you have registered for consent gating. It matches by vendor name, not by URL: a catalog entry named differently from the vendor Analytics detected reads as not yet registered, even if the underlying script is already in your catalog. It shows one of three states:

• In script catalog: the vendor is already registered and active in your script catalog, so its scripts are gated behind consent for the matching category.
• Add to catalog: the vendor is recognized but not yet in your catalog. The link takes you to the Scripts tab so you can register it; hovering it shows a suggested script source for that vendor where one is known.
• "Unrecognized: review manually": Analytics could not match the cookie or embed to a known vendor, so it cannot tell you which catalog entry would gate it. Check it yourself and add a script catalog entry if it belongs to a third-party tool.

The summary line at the top of the page spells out the consequence: vendors not yet in your script catalog are loading without consent gating. Register them on the Scripts tab to bring them under consent control.

When the page is empty

If no scan has been recorded yet, or the most recent scan found no third-party cookies or embeds, the page shows a "No scan yet" state explaining that the scanner runs automatically once the consent script loads. An empty result is also the expected state for a site with no third-party scripts running on it, and for a site with no consent script installed at all: without it on the page, the scan never runs. See Sites for the install snippet.