Docs

Console: Cookies

Run a scan, cascade classification, review queue and promotion.

In Cookies → Run scan, give a start URL and pick the environment. A hosted crawler visits the site, accepts the cookie banner, and reports every cookie and web-storage key it observes — they land in the inventory, already classified. Import scan accepts a JSON array { name, domain, party, expirySeconds? } if you run your own scanner instead.

Classification cascade

  1. Reference DB — a curated dataset of well-known cookies, plus classifications promoted from real reviews. Exact match → confidence 1.0.
  2. Heuristics — name patterns and expiry/party rules.
  3. AI — a model classifies the rest. Anything it is not confident about goes to the review queue.

Review queue & promotion

Classifications below the threshold go to the queue. A HUMAN override is authoritative for that site. When ≥2 independent tenants confirm the same classification, it can be promoted to the shared CookieDefinition — it then resolves at tier 1 for everyone.

These are two separate records that happen to share the same 5-value taxonomy (NECESSARY / FUNCTIONAL / ANALYTICS / MARKETING / PERSONALIZATION), but there is no database relation between them — classifying a cookie does not create or update anything in Cookie categories.

  • A cookie’s category (the Category column in the inventory) — the technical tag set by the classification cascade (or a human override). It is documentation: what this cookie is, cookie by cookie.
  • Cookie categories (Consent → Cookie categories) — the Purposes the visitor actually sees and toggles in the banner: legal text, legal basis, whether it’s required. Created and edited by hand, never automatically from a scan.
A Purpose’s category field (not its key) is what actually gates real consent: it activates scripts marked <script type="text/plain" data-tc-consent="analytics"> and the automatic blocking of known third-party domains. If you classify cookies as MARKETING but have no published Purpose with category: MARKETING, no script tagged as marketing will ever activate — not even on accept, because there is nothing to accept.

When a scan finds a confidently-classified category with no matching Purpose, it leaves an alert ("Add category") on this page to create one — but that is a one-time nudge, not continuous sync: if you later delete or rename a Purpose, the inventory won’t tell you.

PreviousRegulatory content