Your website · Updated October 24, 2026
Why does our website set cookies we never added?
Updated October 24, 2026
Cookies your team never added were set by the tools on your website. Analytics and ad tags, embedded videos and maps, chat widgets, booking forms and your host's security layer each write their own. Open the site in a private window, list the cookies in your browser's developer tools, and match each one to its tool.
If a scan lists cookies nobody added, trace each one to a tool on your pages
If someone ran a scan of your website and sent you a list of cookies your team never added, the cookies almost always came with something that was added on purpose: an analytics tag, an ad platform's tag, an embedded video or map, a chat widget, a booking form, or the security service in front of your site. Nobody typed those cookies in. Each tool brought its own.
A cookie is a note a server asks the browser to keep. Mozilla's web documentation, MDN, defines it as "a small piece of data a server sends to a user's web browser," which the browser can "send them back to the same server with later requests." Cookies exist because, by default, "the HTTP protocol is stateless": without them a website cannot remember a basket, a login or a visitor who came back. That is why they are on nearly every site, and why the question is never whether your site has cookies but which ones and who put them there.
Find out what is setting them
List the cookies yourself in Chrome's developer tools before you buy a scan
If you want the list without paying for it, your own browser already has it. Open your website in a private window so old cookies do not muddy the list, then open Chrome's developer tools and go to the cookies pane. Chrome's documentation gives the path: Application, then Storage, then Cookies, then pick your site's address.
Read the Domain column first. Chrome describes it as "the hosts that are allowed to receive the cookie." A cookie whose domain is your own site was set for your site, even if a tool's script wrote it. A cookie whose domain is someone else's, such as a video, chat or ad company, is a third-party cookie, and Chrome shows a warning icon beside it.
- Open a private window in Chrome and go to your website.
- Right-click the page and choose Inspect.
- Open Application, then Storage, then Cookies, and click your site's address.
- Write down each cookie's Name, Domain and Expires / Max-Age.
- Click around the site, open a page with a video, a map or a form, and check the list again.
Match each cookie to the tool that set it
Most cookies on a small business website come from a handful of sources, and their names usually give them away.
Google Analytics.
Cookies named _ga and _ga_ followed by an ID. Google's help says the GA4 tag uses them "to distinguish unique users as well as unique sessions," and lists a default of 2 years for each.
Google Ads conversion tracking.
Cookies starting with _gcl_. Google's cookie policy says they help advertisers count "how many times users who click on their ads end up taking an action on their site," and last 90 days.
Embedded YouTube videos and Google Maps.
Cookies under Google or YouTube domains, set by the embed, not by your page.
Your host or security layer.
Names such as __cf_bm or cf_clearance mean Cloudflare sits in front of your site. Cloudflare places __cf_bm on visitors to sites protected by its bot products and calls its cookies strictly necessary to provide the service.
Chat, booking, review and form widgets.
Cookies under the widget company's domain, or with its name in the cookie name.
A tag can be added without anyone touching your website's code. Google describes Tag Manager as a way "to set up and manage tags on your site without changing your website's code," so a cookie can appear after someone added a tag in a Tag Manager container. Check the container's tags as well as the site.
Check in a second browser, because visitors do not all get the same cookies
If your list and a scan's list do not match, the browser may be the reason, not your site. The cookie standard, RFC 6265, says some browsers "refuse to send the Cookie header in third-party requests" and others refuse to accept third-party cookies at all, and that browsers "vary widely in their third-party cookie policies." Browsers also cap how long a site's own cookies last: Google's Analytics help gives a maximum of 400 days in Chrome and 7 days in Safari for a visitor who does not come back.
Ask which browser produced any scan you are shown. One browser's list is one sample, so check yours in Chrome and in Safari or Firefox before treating any list as complete.
Decide what stays
Remove the tools nobody uses, because their cookies go with them
If a cookie traces back to a widget, a tag or a plugin nobody on your team can name a use for, take the tool off the site. Removing an unused tool is the cheapest way to cut cookies, and it can make pages load faster too. Old ad platform tags from a campaign that ended, a chat widget nobody answers and a second analytics tool are common finds.
Keep a short list of every tool on the site. Write down what each one does, which cookies it sets and who added it. The next time a scan arrives, the list answers it in minutes.
Switch YouTube embeds to privacy-enhanced mode
If your pages embed YouTube videos, change each embed's address from youtube.com to youtube-nocookie.com. YouTube's help says a view in this mode "will not be used to personalize the YouTube browsing experience" and that ads served on it "will likewise be non-personalized."
Make your consent banner actually hold back the tags
If your site shows a cookie banner, open the site in a private window, do not click the banner, and check the cookies pane. If analytics or ad cookies are already there, the banner is only a notice: the tags load before anyone chooses.
Google's consent mode has two settings, and they behave differently. In basic consent mode, Google says its tags are blocked until a visitor interacts with the banner, and "no data is sent before a user consents." In advanced consent mode, the tags load at once and, while consent is denied, send "measurements without cookies"; cookies are written only once a visitor agrees. Either way, the tags have to be wired to the banner, which is a setting in Tag Manager or in the banner tool, not something the banner does on its own.
Do cookie rules apply to a business that only serves customers in the United States?
Possibly, and it depends on where your visitors are, not where your business is. MDN lists the EU's GDPR and ePrivacy Directive and the California Consumer Privacy Act among the rules that cover cookies, and says they "apply to any site on the World Wide Web that users from these jurisdictions access," with California's law applying only to businesses above its thresholds. It also says the rules can require "allowing users to use the bulk of your service without receiving cookies," which a banner alone does not do. MDN's own line is that "the burden is on you to know and comply with these regulations." A privacy lawyer can say which apply to your business.