How Do Cookie Consent Platforms Scan and Categorize Third-Party Tracking Cookies Under the ePrivacy Directive?
How cookie consent platforms scan and categorize third-party trackers: headless crawling, tracker database matching, ePrivacy 5(3) and the four categories.
In short
Cookie consent platforms simulate pre- and post-consent scenarios with a headless browser; they match cookies, localStorage, pixels and third-party scripts against a tracker database and categorise them as necessary, preferences, analytics or marketing. Under ePrivacy 5(3) the non-essential ones cannot run before consent; Cookietrace combines deep scanning with Prior Blocking.
- Cookietrace Privacy Engineering Team — Published 2026-09-14 · 8 min read
What does Article 5(3) of the ePrivacy Directive say?
Article 5(3) requires prior informed consent before any non-essential information is stored on or read from the visitor's device. It covers HTTP cookies, localStorage, device fingerprinting, pixels and tracking beacons; combined with the GDPR, a non-essential tracker cannot run before consent.
How does a CMP scanner inspect your site?
A headless browser behaves like a real user, crawls pages, simulates consent-given and consent-denied scenarios and records what loads at each step.
- Pages crawled with a headless browser
- Network requests captured before and after consent
- HTTP cookies, localStorage, sessionStorage and IndexedDB monitored
- Pixels and beacon requests recorded
- Scripts matched against a third-party tracker database
- Fingerprinting signals flagged
How are cookies categorised?
Findings are grouped by provider and purpose into four standard categories compatible with IAB TCF and Google Consent Mode v2.
- Necessary: session, security — no consent required
- Preferences: language, region
- Analytics: GA4, measurement — consent required
- Marketing: advertising, retargeting — consent required
Why is a one-time scan not enough?
Marketing teams add tags to GTM, agencies swap pixels. Scheduled rescanning reflects new trackers into the banner and policy automatically.
How Cookietrace's deep scan works
Cookietrace's automated deep scan crawls pages in pre- and post-consent scenarios, detects cookies, localStorage entries, pixels and third-party scripts and sorts them into the four categories. Results feed the multi-language banner and cookie policy. With Cookietrace's Prior Blocking setting enabled, scan-detected non-essential trackers — via GTM or embedded directly — are not executed until the visitor chooses; on reject they never run, on accept only accepted categories load.
Honest boundary
No scan is set-and-forget and no CMP eliminates fine risk. A correct setup removes the most frequently penalised violation and makes it provable with timestamped records; keeping the cookie policy current remains a separate obligation.
Frequently asked questions
Cookie consent platforms simulate pre- and post-consent scenarios with a headless browser; they match cookies, localStorage, pixels and third-party scripts against a tracker database and categorise them as necessary, preferences, analytics or marketing. Under ePrivacy 5(3) the non-essential ones cannot run before consent; Cookietrace combines deep scanning with Prior Blocking.
Does scanning only find cookies?
No; scans also monitor localStorage, pixels, beacon requests and fingerprinting signals.
Which categories are cookies sorted into?
Necessary, preferences, analytics and marketing; all but necessary require consent.
What happens to cookies missing from the database?
They are labelled by behaviour and flagged for review.
How often should rescanning run?
Scheduled scans prevent drift; Cookietrace offers an automated deep scan.
Do trackers stop automatically after a scan?
Scanning detects them; stopping requires Prior Blocking to be enabled.
Are trackers loaded via GTM scanned too?
Yes; the headless browser loads the page like a real user, and blocking covers GTM-loaded trackers too.
Sources
Official sources cited in this guide.
Who should read it
Website owners, marketing teams and developers responsible for cookie consent, analytics tagging and privacy documentation.
Cookietrace
Written and reviewed by the Cookietrace Privacy Engineering Team. (8 min — technology)