How to check website cookies on your own site, with no tool

You can check website cookies on your own site with the phone in your pocket and the browser you already use. You don’t need an account anywhere. What you need is a method, because the list of cookies is the easy part. The hard part is reading it.

Most guides stop at “open the developer tools and look under Cookies”. That shows you names. It doesn’t tell you which of them loaded before anyone answered the banner, or which ones stayed after a visitor tapped Reject. Those two questions are the ones regulators ask, so this guide is built around them.

Here’s what it covers: what you’re looking for, the three visits that answer it, how to read the list, what regulators found when they ran the same test, and how to fix what you find.

What you’re looking for when you check website cookies

Three questions, in this order:

• Before the banner: what did the page store or send while the banner was still on screen, untouched?
• After Reject: what did the page store or send after the visitor said no?
• The list itself: what does each cookie do, who set it, how long does it last, and does your cookie policy name it?

The first two are about timing. In the EU, Article 5(3) of the ePrivacy Directive says storing information on a device, or reading what’s already there, is allowed only on the basis of consent or necessity for a narrow set of purposes. In the UK, PECR regulation 6 was rewritten on 5 February 2026 and now points to a list of exceptions in Schedule A1. The ICO’s reading of the new list is plain: online advertising purposes are not exempt and never have been.

One more thing before you start. Cookies are not the whole picture. The ICO’s guidance lists tracking pixels, scripts, web storage, link decoration and device fingerprinting next to cookies under the same rule. The EDPB’s guidelines on the technical scope of Article 5(3), adopted on 7 October 2024, describe a tracking pixel as a link to an image whose sole purpose is to automatically establish a communication with the pixel’s host. A pixel sets no cookie and still counts. So when you can, look at requests as well as cookies.

How to check cookies on a website from a phone

This takes ten minutes on an iPhone and needs nothing installed. Safari keeps a list of every domain that stored data on your phone, and you can clear it and watch it fill.

1. Clear the slate. Open Settings, then Safari, then Advanced, then Website Data, and remove all website data. Close every Safari tab.
2. Visit your homepage. Open Safari, type your address and wait for the page to finish loading. Do not touch the banner. Count to ten, then close the tab.
3. Read the list. Go back to Website Data. Every domain shown there stored something on your phone during that visit, with the banner still unanswered. Your own domain is expected. Write down every other one.
4. Clear again and visit with a no. Remove all website data, open your homepage, and tap Reject, or the closest thing your banner offers. Open two more pages. Close the tab and read the list again. Anything new that isn’t yours stayed after a refusal.
5. Clear again and visit with a yes. Same again with Accept. This is your full list, and it’s the one your cookie policy should describe.
6. Compare the three lists against your policy. A domain that appears in visit one or two and isn’t a login, a basket or your own site is the first thing to look into. A domain that appears in visit three and isn’t in your policy is the second.

Chrome on Android keeps a similar list under Settings, Site settings and All sites, with the data each site stored. The steps are the same: clear, visit, read.

Going further with the browser’s own tools

On a laptop, any browser’s developer tools give you names, values, domains and expiry dates. The method is the same three visits, in a private window so no earlier choice carries over.

• Open a private window, open the developer tools, and load your homepage. Leave the banner alone.
• Under the Application tab (called Storage in some browsers), open Cookies and click your domain. Each row is a cookie: name, value, domain, expiry. Note every row. Then open Local Storage and Session Storage and do the same, because tags store identifiers there too.
• Open the Network tab and reload. Every row is a request. Sort by domain and note every domain that isn’t yours. Those are the connections your page opened before anyone said yes, and a pixel shows up here even though it never wrote a cookie.
• Close the window, open a new private one, repeat with Reject, and compare. Then once more with Accept.

Three lists, three columns on a notepad. That’s your cookie audit, and it cost nothing.

How to read what you found

The names on their own tell you less than you’d hope, but a few patterns help:

• Domain: a cookie set on your own domain by a third-party script (analytics and advertising cookies often start with an underscore, like _ga or _fbp) is still that third party’s cookie. It belongs on the consent side of the line.
• Expiry: a cookie that ends when the tab closes is usually doing a job for the visitor. One that lasts a year is usually remembering the visitor for somebody.
• Before the banner: anything in visit one beyond your own session, basket, login or consent-choice cookie needs a reason. The two reasons the EU rule accepts are carrying the communication itself and being strictly necessary for a service the visitor asked for.
• After Reject: visit two should look like visit one. If it looks like visit three, the button isn’t connected to anything.
• Against the policy: every domain in visit three should be named, with its purpose and how long its cookies last. The Court of Justice ruled in 2019 that the information a visitor gets must include the duration of the cookies and whether third parties may have access to them.

One thing I can’t settle for you: where exactly “strictly necessary” ends. The EU taskforce said in 2023 that deciding which cookies are essential raises practical difficulties, because cookie features change so often that no stable list can be kept. So you decide per cookie, from the visitor’s side, and write down why.

The UK gives you one extra question since February 2026. The ICO’s guidance describes an exception for cookies whose sole purpose is to collect statistical information to improve your own service, as long as you tell people and give them a simple, free way to object. So a UK analytics cookie in visit one may be fine. An advertising cookie there is not, by the ICO’s own words.

What regulators saw when they ran the same test

The three visits above are not my invention. When the ICO assessed the top 1,000 UK websites, it tested the same three things: whether advertising cookies were stored before the visitor could choose, whether rejecting was as easy as accepting, and whether advertising cookies were placed without consent. By its December 2025 update, 415 sites had passed from the start, 564 had changed after a letter, 17 had received preliminary enforcement notices and 21 were still being worked on.

A few decisions show what each list looked like in practice.

Visit one, before the banner. In September 2024 the ICO reprimanded Sky Betting and Gaming after finding that from 10 January to 3 March 2023, people’s information was shared with advertising technology companies as soon as they accessed the website, before they could accept or reject advertising cookies. The company made changes in March 2023 so that visitors could reject first. In Romania, the data protection authority fined a law office 20,000 lei in November 2025 because opening its websites placed cookies that were not technically necessary without prior consent, between May and October 2025.

Visit two, after a refusal. On 1 September 2025 the CNIL fined the operator of shein.com €150 million. It found advertising cookies placed as soon as users arrived on the site, and that after Refuse all, new cookies were still placed and ones already present continued to be read. In November 2025 it fined American Express Carte France €1.5 million after finding advertising trackers placed despite the user’s expressed refusal, and trackers already placed still being read after consent was withdrawn. The company had corrected its setup during the procedure, and the fine stood.

Fixing what the lists show

Most of the time the cause is a tag running outside the banner’s control. The usual places to look:

• A tag manager trigger set to fire on page load instead of on the consent event.
• A script pasted straight into the theme or a page template, years ago, by someone who has since left.
• A chat widget, video embed, map or social button that loads its own trackers the moment it renders.
• A banner tool that only hides the banner on Reject and never tells the tags.

The fix is the same in each case: every non-essential tag starts from the banner’s consent event, nothing starts on page load, and embeds load a placeholder until the visitor says yes. Then run the three visits again on your phone. The second list should match the first.

If you want to know what each kind of cookie is for before you sort yours, types of website cookies walks through them. For pixels on their own, there’s what a tracking pixel is, and for the banner itself, cookie consent examples.

Peeky reads the public pages of your site. For cookies that load before the banner is answered, the checks are EU-01 and UK-01 in the Handbook, and EU-02 for tracking that carries on after Reject.

Questions people ask

Is it better to accept or reject cookies when I check my own site?

Do both, on separate visits. The reject visit is the one that matters most, because regulators have fined sites where the button changed nothing. In November 2025 the CNIL found that on vanityfair.fr new cookies were still placed after a visitor clicked Refuse all, and fined the publisher €750,000.

What data do cookies store?

A cookie is a short text entry with a name, a value, the domain that set it and an expiry date. The value is often an identifier that lets a server recognise the same browser next time. The ICO describes cookies as small text files generated by a web server that the browser sends back on later requests.

How do I find my website cookies without a tool?

On an iPhone, Safari keeps a list of every domain that stored data on your phone under Settings, Safari, Advanced, Website Data. Clear it, visit your site, and read the list. On a laptop, the browser's developer tools show each cookie by name under the Application or Storage tab, and the Network tab shows every request the page made. The steps are in the guide above.

Can a website set cookies before I click accept?

Only the ones needed for something the visitor asked for, like a login or a basket. In the EU, Article 5(3) of the ePrivacy Directive allows storing or reading information on a device only on the basis of consent or necessity. In the UK, the ICO says online advertising purposes are not exempt from the consent rule and never have been.

Does a cookie audit cover tracking pixels too?

It should. The ICO's guidance lists tracking pixels, scripts, web storage and fingerprinting alongside cookies as storage and access technologies. The EDPB's 2024 guidelines say the EU rule covers similar technologies, not cookies alone. A list of cookie names misses a pixel, so look at requests as well.