Privacy finding
Cookies and browser storage set without consent, unclassified, long-lived or third-party
Privacy Error Severity: High
Part of the audit Cookies and browser storage. Finding id: privacy.cookieFindings.
What it costs you
The cookie is stored before the visitor has agreed to it.
What to do
Give every cookie a category in the consent tool, make the script that sets it wait for consent, and shorten lifetimes that are longer than the purpose needs.
What it checks
- Cookie set before consent
- Cookie set after visitor said no
- Cookie with unknown purpose
- Cookie lasts too long
- Cookie set by another company
- Visitor IDs kept in browser storage
- Cookie set only after visitor action
How to fix it
Make the script that sets the cookie wait for consent
Give the cookie a category
- Find the script named under 'set by' in the evidence.
- Give the cookie a category in your consent tool and add it to the cookie list.
How to check: Run this rule again after the next crawl.
Shorten the lifetime
- Cookie set by your own code: set a shorter expiry.
- Cookie set by a vendor script: look for a lifetime setting in that tool.
How to check: Run this rule again: the lifetime is at or below [max cookie days] days.
Confirm the third-party cookie
- Find what loads [host] and who asked for it.
- Keep it and name it in the cookie list, or remove what loads it.
How to check: Run this rule again after the next crawl.
A real case
France's data protection authority found that when visitors to shein.com clicked Refuse all, or withdrew their consent, new cookies were still placed and cookies already there were still read. In September 2025 it fined the company 150 million euros.
Thresholds
| Name | Default | Meaning |
|---|---|---|
max_cookie_days | 395 | Longest lifetime in days a cookie may have before it is reported. 395 days is 13 months. |