Why Public Cookie Databases Can’t Identify So Many Cookies

Your latest privacy scan finds 312 cookies. You recognize maybe 40 of them. The rest: unknown names, unknown owners, unknown purpose.

So the cookie identification detective work begins. Google the name. Check a public cookie database. Dig through internal documentation. Ping Marketing on Slack. Ask Engineering. Somewhere, someone who left the company two years ago probably knows the answer.

Sound familiar? This isn’t unusual. Most privacy teams know the drill.

Finding where cookies are on your site is hard enough. Understanding what they actually do is harder, and many of the tools built to help don’t fully solve either problem.  

Privacy regulations like GDPR, the ePrivacy Directive, and CCPA/CPRA converge on the same requirements: you have to know what each cookie does, its purpose, and where that data goes. 

An unknown or miscategorized cookie means you can’t inform a regulator, a customer, or your own legal team. Cookie identification is the starting point for consent accuracy, audit readiness, and vendor accountability.

Most Cookie Databases Aren’t Keeping Up with Your Website

For years, privacy teams have leaned on public cookie databases to answer one simple question: what is this cookie doing on my website? The problem is that most of those databases were never built to keep up with how enterprise websites actually change. 

New vendors get added. Campaigns launch and die. Tags get deployed and forgotten. A cookie that exists today may vanish tomorrow. 

Researchers in a study published in 2024 sampled 30,000 websites to test cookie banner tools and needed to classify the cookies they found. Utilizing Cookiepedia, a widely used public cookie database, they could only classify 38% of the distinct cookies.  The other 62% went unidentified.

Will LLMs Replace Cookie Databases?

It’s tempting to think AI could solve the cookie identification problem. Just ask an LLM what a cookie does, right? The very nature of LLMs handicaps their results. Why aren’t LLMs a good solution to identify cookies?

Capability
LLMs don’t natively recognize cookies, tags, or tracking pixels. They weren’t trained to detect those patterns, and they often rely on those very same outdated cookie databases to know what each one does. If it doesn’t exist in one of those databases, the database just returns no answer.

Determinism
LLMs are probabilistic, not factual. They generate the most statistically likely answer, not the correct one, which is why they hallucinate. In our own testing, LLMs fabricated cookies and tags that didn’t exist more than 50% of the time and correctly categorized real ones less than 50% of the time. Preventing that kind of error requires a deterministic tool built on verified data.

Consistency
Ask an LLM the same question twice, and you may get two different answers. Inconsistent output means false positives, and false positives mean analysts waste time chasing down errors.

Cookie Governance Requires More Than Categorization

Cookie categories are an important first step in collecting user consent, allowing them to agree to the type of cookies they will accept. Cookie consent categories sort cookies by function, typically: necessary, performance, functionality, and targeting or advertising. They tell the visitor broadly what a cookie is for, so websites must categorize a cookie correctly.

Even a correctly categorized cookie doesn’t answer the questions privacy teams actually need to manage. Who approved this cookie? Which team owns it? Why was it added? When was it last reviewed? Is it still needed? Can it be safely removed?

Those answers don’t live in any external database. They live inside your organization, usually in someone’s memory. When that person changes roles or leaves the company, the knowledge can often leave with them. The next privacy review would start from the beginning. The same questions get asked again. The same research gets repeated, and resources are wasted.

That’s a clear governance problem, and no existing database, however fast or accurate, was built to solve it. Until now.

The Cookie and Tag Database Built from Billions of Real Scans

A real answer starts with complete data and an honest read on how confident that answer is.

ObservePoint’s Cookie and Tag Database is built from years of real scans across enterprise websites, rather than a public crawl, a one-time research pass, or a model’s guess. Every entry comes from an actual cookie observed in the wild and includes what tags set it, what it’s used for, what category it’s most commonly found in, its risk level, and how prevalent it is. Instead of a single label, each entry shows the evidence behind it with a detailed paragraph on the cookie’s purpose and the reasoning behind its risk level. Every entry is also reviewed by a person before it reaches a customer. 

The result is deterministic: the same cookie returns the same answer every time.

The database also lets users edit the institutional record next to the definition itself: who approved a cookie, who owns it, when it was last reviewed, so that answer survives longer than the person who gave it.

ObservePoint’s Cookie and Tag Database is the most comprehensive and accurate. ObservePoint has defined, categorized, and risk-assessed more cookies than any public cookie database. 

• Built from over 10 years of real scans
  
• 4.2 billion cookies observed
• 18.8 billion tags identified
• 100% human-curated database

You can also take advantage of ObservePoint’s other features like patented cookie origin reporting and tag and cookie initiators. To see a sample of the Cookie and Tag Database’s thorough information, head over to our index of the 100 most commonly used cookies.

And if you ever find a cookie we haven’t seen yet, tell us. We’ll add it.