Cookie Inventory
A catalog listing each cookie name, domain, expiration, type (strictly necessary, performance, targeting), and whether it is first- or third-party, including script source and vendor contact information for vendor management.
Maintaining a Business Cookies Document reduces regulatory risk, improves transparency for consumers, and provides evidence of compliance with consumer privacy laws and company policy. It centralizes technical and legal details so teams can respond to inquiries, audits, or security incidents with documented controls and consistent language.
Teams that typically prepare and consult this document before public release or audit.
Keep the document accessible to cross-functional stakeholders and update it when new tags, vendors, or processing purposes change.
A catalog listing each cookie name, domain, expiration, type (strictly necessary, performance, targeting), and whether it is first- or third-party, including script source and vendor contact information for vendor management.
Clear descriptions of processing purposes such as session management, analytics, personalization, security, or advertising, paired with the legal justification and any reliance on legitimate interest or consumer consent.
Per-cookie retention periods and rationale, including automatic deletion or rotation policies, and any retention variation for aggregated or pseudonymized data.
Documentation of consent flows, granular consent options presented to users, how consent is recorded, and mechanisms for withdrawing consent for specific cookie categories.
Vendor list, contract references, and whether a Business Associate Agreement or Data Processing Addendum is required for vendors that process regulated personal data.
A dated history of additions, removals, or purpose changes for cookies with references to release versions, responsible owners, and reviewer approvals.
| Field | Configuration |
|---|---|
| Cookie Name | Sync with tag manager and CMP glossary |
| Category | Map to CMP consent categories (necessary, analytics) |
| Consent Record | Store timestamp, IP, user agent, and consent choices |
| Review Cadence | Quarterly review and after major releases |
Ensure chosen tools can export structured inventories, record consent events, and integrate with tag management systems.
Prefer systems that provide role-based access controls and retention configuration to meet legal and operational requirements.
Publish updated privacy notice at product launch or before new tracking goes live
Conduct a cookie inventory review at least quarterly
Respond to CCPA/CPRA requests within 45 days of receipt
Reconfirm consent after material changes or annually for high-risk processing
Follow applicable state breach notification timelines upon compromise
A mid-sized ecommerce retailer logs all cookies used for cart persistence, analytics, and advertising
A medical appointment portal documents cookies to ensure no PHI is captured by marketing tags
The CPO or equivalent privacy lead usually approves the legal and consumer-facing language, certifies the legal basis for processing, and oversees consent strategy across products and jurisdictions.
An authorized engineering or product leader signs off on technical accuracy, confirms implementation of blocking and enforcement mechanisms, and accepts operational responsibility for maintaining the inventory.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | Yes, 30-day trial | No | No | Yes, limited | Yes, limited |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |