# Your Banner Lists 12 Trackers. Your Site Runs 40: The Cookie Audit Gap

Source: https://cookierampart.com/blog/2026-11-14-banner-lists-12-trackers-site-runs-40.html

[Home](../index.md) / [Blog](index.md) / Your Banner Lists 12 Trackers. Your Site Runs 40: The Cookie Audit Gap


Published 2026-11-14

A consent team runs its CMP's cookie scan, gets a tidy list of 12 cookies, and publishes it in the cookie policy. Then someone loads the site in a clean browser with the network tab open and counts 40 requests to tracking domains before touching the banner. Both numbers are real. The scan counted what it could see, and the site runs more than the scan can see.

The gap is not a rounding error. It is the difference between the consent record and the actual data flow, and it is the first thing a regulator checks, because it is the easiest thing to check.

## Where the extra 28 hide

Embeds are the biggest source. A YouTube video sets VISITOR\_INFO1\_LIVE, YSC, and an IDE cookie on doubleclick.net the moment the page loads, before anyone presses play. A store locator map pings Google before consent. A chat widget fingerprints the visitor before hello. None of these appear in a scan that runs after consent is given, because the scan sees the site in its consented state, not its pre-consent state.

Tag manager side-loads are the second source. The tag manager itself is one script, but it pulls in analytics, A/B testing tools, heatmaps, and ad pixels, each with their own cookies. VWO sets \_vwo\_uuid, Optimizely sets optimizelyEndUserId, and neither appears in a scan that only looks at first-party cookies. Single-page apps add a third source: route changes that fire new tags without a page load, which a scan of the homepage never triggers.

## Why the scan misses them

Most CMP scans run on a schedule, not on a deploy. They crawl the site as a consented visitor, follow the links the crawler can reach, and report the cookies they find. A tracker that only fires for a logged-in user, on a checkout page, or after a specific interaction never appears. A tracker loaded by a third-party iframe sets its own cookies in its own context, and the scan has no view into it.

The EDPB's cookie banner taskforce, reporting in January 2023, identified ten categories of non-compliant practices, and the gap between the declared list and the actual trackers sits behind most of them. The taskforce's finding was not that teams lie about their trackers. It was that teams do not know what their sites run.

## The audit that catches them

Load the site in a clean browser profile with the network tab open and the banner untouched. Record every request to a third-party domain before any choice is made. Then accept all cookies, reload, and record again. The difference between the two lists is the consent-gated set, and the first list is the one that matters: anything on it fired without consent.

Compare that first list against the cookie policy line by line. Anything that fires and is not listed is a finding. Anything listed that no longer fires is a smaller finding, but it still means the policy is not maintained. Run the audit after every deploy that touches tags, embeds, or the tag manager, and quarterly otherwise. Trackers arrive through marketing changes, not just code changes.

Keep reading: [Your CMP Migration Left the Old Consent Records Behind](https://cookierampart.com/blog/2026-11-13-cmp-migration-old-consent-records.md), [Consent Records: What to Keep When a Visitor Says No](https://cookierampart.com/blog/2026-11-11-consent-records-what-to-keep.md), [The Site With No Cookies: Do You Still Need a Banner?](https://cookierampart.com/blog/2026-11-10-no-cookies-still-need-banner.md) cover the nearby cases in this series.

## Frequently asked questions

### Why does my CMP scan miss trackers my site actually runs?

Scans usually run as a consented visitor, so they miss trackers that fire before consent, trackers that load only for logged-in users or on specific pages, and cookies set inside third-party iframes. A manual pass in a clean browser with the network tab open catches them.

### What is the most common hidden tracker?

Embedded content: YouTube videos, maps, and chat widgets. A standard YouTube embed sets tracking cookies on page load before anyone presses play, and a chat widget can fingerprint a visitor before hello. Neither appears in a first-party cookie scan.

### How often should I audit my trackers?

After every deploy that touches tags, embeds, or the tag manager, and quarterly at minimum. Trackers arrive through marketing changes as well as code changes, so the audit has to run on the live site, not the repo.

### What do I do with trackers the audit finds?

Add them to the cookie policy with all six fields, gate them behind consent in the tag manager, and record the fix. If a tracker cannot be gated, remove it or replace the embed with a click-to-load facade.