Overview
This check reconciles every cookie observed during a crawl against a documented, authorized master registry that maps each cookie to a specific category (Strictly Necessary, Functional, Performance, Targeting), flagging any cookie that appears in the crawl but not in the registry.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific GDPR compliance obligations.
Why it is important
An unmapped cookie dropping via your domain represents undocumented data processing and you cannot demonstrate a lawful basis, an accurate retention period, or an appropriate disclosure for a cookie your organization hasn't formally reviewed and registered, which is precisely the accountability gap GDPR's Article 5(1)(a) lawfulness/fairness/transparency principle is designed to close.
Because new cookies are introduced continuously as marketing and analytics vendors update their own scripts, this reconciliation can only be partially automated with ObservePoint reliably surfacing every observed cookie, but assigning the correct category to a genuinely new cookie requires human review of its actual purpose.
Implementation
Import your approved cookie categorization into ObservePoint's consent categories.
Configure a scheduled, full-property Audit with cookie inventory enabled, assign the consent categories to it, and run it on a recurring cadence (weekly, or at minimum your quarterly full-site schedule).
Check the pre-built ObservePoint report for unapproved Cookies.
Detection is fully automated, but categorization isn't. The platform can tell you a cookie exists, not why a vendor sets it or which bucket it belongs in. Route any cookie the report surfaces to the vendor/tag owner for that determination, then add it back into your approved inventory and consent categories.
Remediation
For remediation, follow the next steps:
For each newly discovered or unmapped cookie, identify the owning vendor or script and determine its actual function - this generally requires input from the vendor or the internal team that added it, since the cookie name alone rarely reveals its true purpose or appropriate category.
Once categorized, update both your authorized cookie register and the corresponding consent category mapping in your CMP and in ObservePoint so future crawls classify it correctly on sight.
If the cookie was introduced by a vendor with no corresponding Data Processing Agreement on file, escalate through the Third-Party Vendor Accountability policy's DPA-verification check before treating the categorization as complete.
Conclusion
Treat this as an ongoing reconciliation discipline rather than a one-time cleanup exercise — pairing it with the quarterly full-site cadence keeps cookie drift from accumulating into a backlog that's far harder to triage once it grows large.