Privacy finding
The published cookie list and the cookies the browser received differ
Privacy Warning Severity: Medium
Part of the audit The cookie list says one thing, the browser shows another. Finding id: privacy.cookieListVsScan.
What it costs you
The cookie list is what you tell visitors you do. The browser shows something else.
What to do
Update the published list from what the scan found, or remove the cookie.
What it checks
- Cookies found but not declared
- Cookies declared but never found
- Declared lifetime differs from actual
- Declared provider differs from actual
How to fix it
Add the cookie to the list or stop setting it
- Find what sets the cookie: see the example page.
- Add it to the list with its purpose, provider and lifetime, or stop setting it.
- If a consent platform generates the list, run its scan again and compare.
How to check: Crawl the site again. The cookie no longer appears in this rule.
Remove entries of cookies that are gone
- Ask the team that owned the tool whether the cookie is still set anywhere, for example in checkout or after login.
- If not, remove the entry.
How to check: Crawl the site again. The cookie no longer appears in this rule.
Correct the entry to the observed value
- Correct the lifetime or domain in the list to the observed value, or change the cookie to what the list says.
How to check: Crawl the site again. The cookie no longer appears in this rule.
A real case
The Belgian data protection authority found that a legal information website used Google Analytics cookies without consent while the cookie list it supplied did not mention them. It fined the company 15,000 euros in December 2019.
Thresholds
| Name | Default | Meaning |
|---|---|---|
lifetime_tolerance_days | 1 | Difference in days between the declared and the observed lifetime that is still accepted. |
How to verify by hand
The consent platform's own scan report; a person for cookies set only in rare flows.
What this relies on
The scan is right and the published list is out of date.