Scheduled Cookie Scans: Automated Compliance Monitoring

The €425,000 Cookie Nobody Noticed

Illustrative scenario: a composite example, not a specific reported case.

A German retail company ran quarterly compliance audits. Every three months, an agency scanned their website, reviewed cookies, and issued a report. The audits were clean.

Then the CNIL (French regulator) scanned their .fr domain and found a tracking pixel that had been added 11 weeks prior—two weeks after the last audit. The pixel was firing before consent, collecting data on every French visitor.

Quarterly audits missed 82 days of violations. The fine: €425,000. The fix: automated scanning that would have caught the issue within 24 hours.

Manual audits are snapshots. Automated scans are surveillance.

Why Websites Drift Out of Compliance

Marketing Adds Tools

Someone installs Hotjar to understand user behavior. They don't tell the compliance team. The script loads before consent.

Developers Deploy Changes

A new feature requires a third-party service. The integration goes through code review but not privacy review. New cookies appear.

Plugins Update

Your WordPress plugins auto-update. A new version includes analytics you didn't ask for. Your cookie inventory changes overnight.

Third Parties Evolve

The advertising pixels on your site don't stay static. Networks add new cookies, change domains, modify behavior. Your site's cookie footprint changes without you doing anything.

Scheduled Scans in GetCookies

Scan Frequencies

Schedule	Best For
Daily	High-traffic sites, regulated industries
Weekly	Active development, frequent changes
Bi-weekly	Stable sites with periodic updates
Monthly	Static sites, minimal changes
Custom	Specific business requirements

Configuration Options

Schedule Type:

• Fixed time (e.g., every Monday at 3 AM)
• Interval (e.g., every 7 days)
• Cron expression (e.g., 0 3 * * 1 for Monday 3 AM)

Timezone:

• Schedule runs in your specified timezone
• Useful for scanning during off-peak hours

Pages to Scan:

• Homepage only
• Sitemap discovery
• Custom URL list
• All public pages

What Gets Scanned

Each scan captures:

• All cookies set during page load
• JavaScript execution timeline
• Network requests to third parties
• Consent Mode signal states
• Script sources and load order

Email Alerts

Alert Types

Alert	Trigger	Severity
New Cookie Detected	Previously unseen cookie	Medium
Cookie Removed	Cookie no longer appears	Low
Cookie Recategorized	Category changed	Medium
Unclassified Cookies	Unknown cookies above threshold	High
Pre-consent Violation	Cookie before consent	Critical
Scan Failure	Scan couldn't complete	Medium

Configuration

{
  "alert_on_new_cookies": true,
  "alert_on_cookie_removed": false,
  "alert_on_cookie_recategorized": true,
  "alert_on_unclassified_cookies": true,
  "min_unclassified_cookies_threshold": 3,
  "recipients": [
    "[email protected]",
    "[email protected]"
  ]
}

Alert Email Content

Subject: ⚠️ New Cookies Detected on example.com

Body:

Scan completed at 2025-01-15 03:00:00 UTC

Changes detected:
• 3 new cookies found
• 1 cookie removed
• 0 cookies recategorized

New cookies:
• _pin_unauth (Pinterest) - Marketing category
• _uetsid (Microsoft) - Marketing category
• _rdt_uuid (Reddit) - Marketing category

Action required: Review and classify these cookies in your GetCookies dashboard.

View full scan results →

Setting Up Scheduled Scans

Via Dashboard

1. Navigate to your domain
2. Go to Settings > Scheduled Scans
3. Enable scheduling
4. Select frequency
5. Set preferred time
6. Configure pages to scan
7. Save

Via API

curl -X POST https://api.getcookies.co/v1/scheduled-scans \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain_id": "your-domain-id",
    "schedule_type": "weekly",
    "schedule_config": {
      "day_of_week": 1,
      "time_of_day": "03:00"
    },
    "timezone": "Europe/Berlin",
    "is_enabled": true
  }'

Setting Up Email Alerts

Via Dashboard

1. Navigate to your domain
2. Go to Settings > Alerts
3. Enable email alerts
4. Select alert types
5. Add recipient email addresses
6. Set unclassified cookie threshold
7. Save

Via API

curl -X POST https://api.getcookies.co/v1/email-alerts \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain_id": "your-domain-id",
    "is_enabled": true,
    "alert_on_new_cookies": true,
    "alert_on_unclassified_cookies": true,
    "min_unclassified_cookies_threshold": 1,
    "recipients": ["[email protected]"]
  }'

Scan History and Trends

Historical Data

View all past scans with:

• Date and time
• Duration
• Cookies found
• Changes detected
• Issues flagged

Trend Analysis

Over time, the dashboard shows:

• Cookie count trends
• Category distribution changes
• Third-party service additions
• Compliance score evolution

Comparison Views

Compare any two scans to see:

• Added cookies
• Removed cookies
• Changed cookies
• New third parties

Multi-Domain Monitoring

For agencies and enterprises managing multiple sites:

Bulk Configuration

Apply scan schedules to:

• All domains in organization
• Selected domain groups
• Domains matching criteria

Consolidated Alerts

Receive:

• Per-domain alerts
• Daily digest across all domains
• Critical-only notifications
• Custom routing rules

Dashboard Overview

Single view showing:

• Last scan status per domain
• Domains with issues
• Overall compliance posture
• Upcoming scheduled scans

Practical Workflows

Development Team Workflow

1. Daily scans in staging environment
2. Alerts to dev Slack channel
3. Review before production deploy
4. Weekly production scans for verification

Compliance Team Workflow

1. Weekly scans across all domains
2. Alerts to compliance inbox
3. Weekly review meeting for new cookies
4. Monthly trend report to leadership

Agency Workflow

1. Client-specific scan schedules
2. Alerts routed to account managers
3. Monthly client reports generated
4. Quarterly compliance reviews

Handling Alerts

When New Cookies Appear

1. Identify source: Check scan details for script origin
2. Determine legitimacy: Was this intentional addition?
3. Classify appropriately: Assign correct category
4. Update consent: Ensure banner reflects new tracking
5. Document: Note the change for audit trail

When Pre-consent Violations Detected

1. Investigate immediately: Which script is violating?
2. Block the script: Add to consent-blocked list
3. Verify fix: Run manual scan
4. Document timeline: How long was it violating?
5. Consider disclosure: May need to notify affected users

Best Practices

Scan Timing

• Schedule during low-traffic hours
• Avoid scanning during deployments
• Consistent timing helps spot anomalies

Alert Management

• Start with fewer recipients, expand as needed
• Set appropriate thresholds (too low = noise)
• Route critical alerts differently than informational

Response Time

• Critical alerts: Same-day investigation
• New cookies: Within one business day
• Removed cookies: Review within one week

Documentation

• Keep scan history for audit purposes
• Document all classification decisions
• Maintain change log for compliance evidence

Scan vs. Real-Time Monitoring

Aspect	Scheduled Scans	Real-Time (Widget)
Detection	Periodic	Immediate
Coverage	Selected pages	All pages with widget
New cookie discovery	Next scan	As it happens
Resource usage	Batch	Continuous
Offline sites	Yes	No

Both approaches complement each other. Scans catch what the widget might miss. The widget provides immediate protection.

Getting Started

1. Enable scheduled scans for your domain
2. Start with weekly frequency
3. Configure email alerts
4. Review first few scan results
5. Adjust settings based on noise level

Automated monitoring isn't about replacing human judgment—it's about ensuring humans see what needs judging. You can't fix what you don't know about.