Cookie and Tag Forensics with Vendor Inventory

A scanner reports the cookies present on the page it happened to load, in the consent state it happened to be in. The finding that decides anything is the gap between the vendor list you publish and the parties actually receiving an identifier, and on a first pass that gap is routinely a third of the list, with nobody in the room able to name the vendor or remember the campaign it arrived with. The crawl: Headless Chromium driven through the DevTools protocol, four passes over the same route sample: no interaction, refuse all, accept all, and a returning visitor carrying prior state. Routes are chosen by traffic and by sensitivity, so checkout, account, internal search results, and any page whose subject matter is itself a signal about the reader. For each pass I record every third-party host from the request log, including hosts reached only through a redirect chain, plus cookies, localStorage, sessionStorage, IndexedDB and cache storage, keyed by what wrote them. The refuse-all pass is what fills the first page of the report. What a scanner cannot see: Every first-party subdomain gets resolved. A subdomain whose CNAME lands inside an advertising vendor's zone sets first-party cookies that survive browser restrictions and look like yours in any same-site inventory. Fingerprinting surface is recorded separately: canvas readback, AudioContext, device enumeration, font probing. And the tag manager container is exported and read against the crawl, because the tags that fire and the tags in the container are not the same set. The interesting ones are the tags that fire from inside another tag. Attribution: Each host resolves to a legal entity, its establishment, the role it holds, its current transfer basis, and the contract you actually hold with it. That last column is where the work stops being technical, and it is the column that turns a list into decisions. Everything ships as a spreadsheet keyed by storage item, plus a two-page summary written for the person who will read only the summary. Automotive networks: Dealer sites built on a shared template drift independently. The group holds one policy and two hundred sites where local marketing added a chat widget and a call tracker without telling anyone. Sampling for that is designed differently, template instance plus exceptions rather than domain by domain, and it is priced differently. Not included: Mobile SDK inventory, which needs a different instrument and is a different engagement. Remediation beyond the container diff. A design opinion on your banner, which belongs to implementation work. Any deliverable in the form of a tool-generated PDF with a score printed on it. Those exist and they cost less than I do. A condition rather than a preference: If ten people hold publish rights on the tag container, an inventory is a photograph and not a control, and the report will say so. Fixing publish rights costs nothing and has the longest half-life of any change in this work. I would rather agree it before the crawl than argue about it afterwards. Who should not book this: Teams who need the answer to be that everything is fine. The report names vendors, and some of them were brought in by a colleague who still uses them daily. Also anyone hoping for a certificate. Nobody certifies this, and the crawl is true for the day it ran, which is precisely why the standing version of this engagement exists.