Scheduled Cookie Scans: Automated Compliance Monitoring

## The €425,000 Cookie Nobody Noticed A German retail company ran quarterly compliance audits. Every three months, an agency scanned their website, reviewed cookies, and issued a report. The audits were clean. Then the CNIL (French regulator) scanned their .fr domain and found a tracking pixel that had been added 11 weeks prior—two weeks after the last audit. The pixel was firing before consent, collecting data on every French visitor. Quarterly audits missed 82 days of violations. The fine: €425,000. The fix: automated scanning that would have caught the issue within 24 hours. Manual audits are snapshots. Automated scans are surveillance. ## Why Websites Drift Out of Compliance ### Marketing Adds Tools Someone installs Hotjar to understand user behavior. They don't tell the compliance team. The script loads before consent. ### Developers Deploy Changes A new feature requires a third-party service. The integration goes through code review but not privacy review. New cookies appear. ### Plugins Update Your WordPress plugins auto-update. A new version includes analytics you didn't ask for. Your cookie inventory changes overnight. ### Third Parties Evolve The advertising pixels on your site don't stay static. Networks add new cookies, change domains, modify behavior. Your site's cookie footprint changes without you doing anything. ## Scheduled Scans in GetCookies ### Scan Frequencies | Schedule | Best For | |----------|----------| | **Daily** | High-traffic sites, regulated industries | | **Weekly** | Active development, frequent changes | | **Bi-weekly** | Stable sites with periodic updates | | **Monthly** | Static sites, minimal changes | | **Custom** | Specific business requirements | ### Configuration Options **Schedule Type:** - Fixed time (e.g., every Monday at 3 AM) - Interval (e.g., every 7 days) - Cron expression (e.g., `0 3 * * 1` for Monday 3 AM) **Timezone:** - Schedule runs in your specified timezone - Useful for scanning during off-peak hours **Pages to Scan:** - Homepage only - Sitemap discovery - Custom URL list - All public pages ### What Gets Scanned Each scan captures: - All cookies set during page load - JavaScript execution timeline - Network requests to third parties - Consent Mode signal states - Script sources and load order ## Email Alerts ### Alert Types | Alert | Trigger | Severity | |-------|---------|----------| | New Cookie Detected | Previously unseen cookie | Medium | | Cookie Removed | Cookie no longer appears | Low | | Cookie Recategorized | Category changed | Medium | | Unclassified Cookies | Unknown cookies above threshold | High | | Pre-consent Violation | Cookie before consent | Critical | | Scan Failure | Scan couldn't complete | Medium | ### Configuration ```json { "alert_on_new_cookies": true, "alert_on_cookie_removed": false, "alert_on_cookie_recategorized": true, "alert_on_unclassified_cookies": true, "min_unclassified_cookies_threshold": 3, "recipients": [ "[email protected]", "[email protected]" ] } ``` ### Alert Email Content **Subject:** ⚠️ New Cookies Detected on example.com **Body:** ``` Scan completed at 2025-01-15 03:00:00 UTC Changes detected: • 3 new cookies found • 1 cookie removed • 0 cookies recategorized New cookies: • _pin_unauth (Pinterest) - Marketing category • _uetsid (Microsoft) - Marketing category • _rdt_uuid (Reddit) - Marketing category Action required: Review and classify these cookies in your GetCookies dashboard. View full scan results → ``` ## Setting Up Scheduled Scans ### Via Dashboard 1. Navigate to your domain 2. Go to **Settings > Scheduled Scans** 3. Enable scheduling 4. Select frequency 5. Set preferred time 6. Configure pages to scan 7. Save ### Via API ```bash curl -X POST https://api.getcookies.co/v1/scheduled-scans \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "domain_id": "your-domain-id", "schedule_type": "weekly", "schedule_config": { "day_of_week": 1, "time_of_day": "03:00" }, "timezone": "Europe/Berlin", "is_enabled": true }' ``` ## Setting Up Email Alerts ### Via Dashboard 1. Navigate to your domain 2. Go to **Settings > Alerts** 3. Enable email alerts 4. Select alert types 5. Add recipient email addresses 6. Set unclassified cookie threshold 7. Save ### Via API ```bash curl -X POST https://api.getcookies.co/v1/email-alerts \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "domain_id": "your-domain-id", "is_enabled": true, "alert_on_new_cookies": true, "alert_on_unclassified_cookies": true, "min_unclassified_cookies_threshold": 1, "recipients": ["[email protected]"] }' ``` ## Scan History and Trends ### Historical Data View all past scans with: - Date and time - Duration - Cookies found - Changes detected - Issues flagged ### Trend Analysis Over time, the dashboard shows: - Cookie count trends - Category distribution changes - Third-party service additions - Compliance score evolution ### Comparison Views Compare any two scans to see: - Added cookies - Removed cookies - Changed cookies - New third parties ## Multi-Domain Monitoring For agencies and enterprises managing multiple sites: ### Bulk Configuration Apply scan schedules to: - All domains in organization - Selected domain groups - Domains matching criteria ### Consolidated Alerts Receive: - Per-domain alerts - Daily digest across all domains - Critical-only notifications - Custom routing rules ### Dashboard Overview Single view showing: - Last scan status per domain - Domains with issues - Overall compliance posture - Upcoming scheduled scans ## Practical Workflows ### Development Team Workflow 1. Daily scans in staging environment 2. Alerts to dev Slack channel 3. Review before production deploy 4. Weekly production scans for verification ### Compliance Team Workflow 1. Weekly scans across all domains 2. Alerts to compliance inbox 3. Weekly review meeting for new cookies 4. Monthly trend report to leadership ### Agency Workflow 1. Client-specific scan schedules 2. Alerts routed to account managers 3. Monthly client reports generated 4. Quarterly compliance reviews ## Handling Alerts ### When New Cookies Appear 1. **Identify source**: Check scan details for script origin 2. **Determine legitimacy**: Was this intentional addition? 3. **Classify appropriately**: Assign correct category 4. **Update consent**: Ensure banner reflects new tracking 5. **Document**: Note the change for audit trail ### When Pre-consent Violations Detected 1. **Investigate immediately**: Which script is violating? 2. **Block the script**: Add to consent-blocked list 3. **Verify fix**: Run manual scan 4. **Document timeline**: How long was it violating? 5. **Consider disclosure**: May need to notify affected users ## Best Practices ### Scan Timing - Schedule during low-traffic hours - Avoid scanning during deployments - Consistent timing helps spot anomalies ### Alert Management - Start with fewer recipients, expand as needed - Set appropriate thresholds (too low = noise) - Route critical alerts differently than informational ### Response Time - Critical alerts: Same-day investigation - New cookies: Within one business day - Removed cookies: Review within one week ### Documentation - Keep scan history for audit purposes - Document all classification decisions - Maintain change log for compliance evidence ## Scan vs. Real-Time Monitoring | Aspect | Scheduled Scans | Real-Time (Widget) | |--------|-----------------|-------------------| | Detection | Periodic | Immediate | | Coverage | Selected pages | All pages with widget | | New cookie discovery | Next scan | As it happens | | Resource usage | Batch | Continuous | | Offline sites | Yes | No | Both approaches complement each other. Scans catch what the widget might miss. The widget provides immediate protection. ## Getting Started 1. Enable scheduled scans for your domain 2. Start with weekly frequency 3. Configure email alerts 4. Review first few scan results 5. Adjust settings based on noise level Automated monitoring isn't about replacing human judgment—it's about ensuring humans see what needs judging. You can't fix what you don't know about.