Setting Up Cookie Scanner on Website (CookieBot/OneTrust/CookieYes)
Cookie scanner automatically detects all cookies set on the site, classifies them by categories, and generates current Cookie Policy. Without a scanner, you cannot know which third-party services set cookies.
CookieBot: Installation and Setup
<!-- In <head> before all other scripts — mandatory to block cookies before consent -->
<script id="Cookiebot" src="https://consent.cookiebot.com/uc.js"
data-cbid="YOUR_CBID"
data-blockingmode="auto"
type="text/javascript">
</script>
data-blockingmode="auto" — automatically blocks all third-party scripts until consent is obtained. Looks for type="text/plain" data-cookieconsent="statistics|marketing" in script tags.
Script Tagging for Cookiebot
<!-- Analytics cookies — blocked before consent -->
<script type="text/plain" data-cookieconsent="statistics">
// Google Analytics
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-XXXXXXXX');
</script>
<!-- Marketing cookies -->
<script type="text/plain" data-cookieconsent="marketing">
// Facebook Pixel
fbq('init', 'PIXEL_ID');
</script>
<!-- Necessary — always loaded -->
<script type="text/javascript">
// Session management, CSRF — never blocked
</script>
CookieYes (Free Alternative)
<!-- CookieYes snippet -->
<script id="cookieyes" type="text/javascript"
src="https://cdn-cookieyes.com/client_data/YOUR_ID/script.js">
</script>
// React to user consent
document.addEventListener("cookieyes_consent_update", function(eventData) {
const data = eventData.detail
if (data.accepted.includes('analytics')) {
// Activate GA4
initGoogleAnalytics()
}
if (data.accepted.includes('advertisement')) {
initFacebookPixel()
}
})
Programmatic Cookie Check After Consent
// Get consent status
function getCookieConsent() {
const cookieValue = document.cookie
.split('; ')
.find(row => row.startsWith('CookieConsent='))
?.split('=')[1]
if (!cookieValue) return null
try {
return JSON.parse(decodeURIComponent(cookieValue))
} catch {
return null
}
}
const consent = getCookieConsent()
// consent = { necessary: true, statistics: true, marketing: false, preferences: true }
Scanning and Audit
# Manual cookie scanning via Chrome DevTools
# Application → Cookies → select domain
# Automated via Playwright
const { chromium } = require('playwright')
const browser = await chromium.launch()
const context = await browser.newContext()
const page = await context.newPage()
await page.goto('https://company.com')
const cookies = await context.cookies()
console.log(cookies.map(c => ({ name: c.name, domain: c.domain })))
await browser.close()
Implementation Timeline
Installation of cookie scanner (Cookiebot/CookieYes), setup of script blocking before consent — 0.5–1 business day.