Cookiepedia is a public cookie lookup site run by OneTrust, and most of its data was supplied by OneTrust. It is useful for one question: what is a cookie with this name usually for? Its own methodology page lists what it cannot tell you: a cookie’s name is not unique, the site it was recorded on is not necessarily the one that set it, and it stores no cookie values. On its home page, 32% of the cookies it counts are classed as “Unknown”. To find out what a cookie does on your site, check it in the browser (two DevTools filters, below), then read the vendor’s own documentation. For an open, downloadable alternative there is the Open Cookie Database: 2,266 entries under Apache 2.0.
Updated 29 September 2026: rewritten against Cookiepedia’s own methodology pages, with a DevTools lookup method and alternatives. Figures were read on that date.
Who runs Cookiepedia
OneTrust, the privacy software company. Cookiepedia’s about page says the site “is maintained by OneTrust”, and its overview page goes further: “The majority of cookie data on Cookiepedia has been supplied by OneTrust”, which “currently administers the Cookiepedia site.”
That is not a problem in itself, but it tells you whose taxonomy you are reading. The categories, the “Unknown” bucket and the scanner offered on the home page are all OneTrust’s. The home page promotes a free scan by “CookiePro by OneTrust”; CookiePro’s own site now redirects to OneTrust, which says “CookiePro.com Is Now Part of OneTrust.com”. When we followed Cookiepedia’s scan link on 29 September 2026, kiosk.cookiepro.com returned a Cloudflare error (HTTP 530, code 1016) on two attempts. The site footer still reads © 2020, and the IAB TCF page at tcf.cookiepedia.co.uk shows placeholder text (“Purpose 1: purpose name”). The main search still loads.
What is in the database
The home page counters, as served on 29 September 2026:
Cookies recorded 42,020,489
first-party 27,374,825
third-party 14,645,633
Average cookies per site 69
Share by purpose: Targeting 58% · Unknown 32% · Performance 5%
Functionality 3% · Strictly Necessary 1%Cookiepedia does not say how these are counted, so read them as the size of its scan corpus rather than a number of distinct cookies. According to the “Using Cookiepedia” page, the data “is gathered by people using our free plug-ins, the Cookie Collector and Optanon Auditor”. Optanon is also named on the classification page as the source “whose data powers the majority of this service”.
You can search three ways. The site’s search script sends you to /cookies/<name> for a cookie name, /website/<domain> for a site, and /host/<host> for a third-party host. Each record carries a name, the site it was seen on, the host, first- or third-party, path, the Secure and HttpOnly flags, session or persistent, a lifespan and a purpose.
Purposes follow the four categories the UK International Chamber of Commerce proposed (Strictly Necessary, Performance, Functionality, Targeting/Advertising), plus Optanon’s own rules for edge cases. Those rules are editorial choices. One example: cookies from social widgets are generally classed as Functionality when they depend on the visitor already having an account with that network, and as Targeting otherwise. A category in any database is somebody’s label, not a finding about whether a cookie needs consent where you operate. That question depends on the law in your jurisdiction, and nothing here is legal advice.
We could not quote a current entry. On 29 September 2026, individual cookie pages and search results sat behind a Cloudflare security check that refused both our scripted requests and an automated browser. For you, that means lookups are by hand: you cannot script bulk matching against it. If you need that, use the Open Cookie Database below.
Five things an entry cannot tell you
The first three come straight from Cookiepedia’s own documentation. The other two follow from what it records.
- A name is not an identity. “A cookie called ‘lang’ on one website, could be very different from one on another site with the same name.” For common platforms the name is enough; Cookiepedia’s own example is
__utma, “almost certainly always going to be from the Google Analytics service”. Generic names need checking on your own site. - Where it was seen is not who set it. The URL domain field is “the website that the cookie was picked up on, but is not necessarily the site that sets or controls how that cookie works.” When we loaded shopify.com in a clean browser, only 5 of the 15 cookies on
.shopify.comwere written by Shopify’s own server; the rest came from Google and Meta code. The method is in which script set that cookie. - No values. “Cookiepedia does not store the values of any of the cookies that we pick up data on.” That is the right privacy choice, but it means an entry cannot show you whether a cookie on your site holds a random visitor ID, a consent string or an email address.
- Lifespan as written, not as kept. Cookiepedia records the expiry the cookie was set with, rounded to whole days. Browsers cap it: Google’s own GA4 documentation notes a “maximum of 400 days for Chrome and 7 days for Safari” when a user does not come back. The effect on consent cookies is covered in how long cookie consent lasts.
- Cookies only. The database records cookies. Identifiers kept in
localStorageor handed back through an HTTPETagnever appear in it, yet the EDPB’s Guidelines 2/2023 on Article 5(3) list caching mechanisms “such as ETag” next to cookies (paragraph 43). We tested both in storage that is not a cookie.
Look a cookie up yourself, in about five minutes
The only authoritative record of what your site sets is your site. This is the manual method in Chrome; Firefox has an equivalent Storage panel.
1. Start clean and open DevTools first. Use a fresh profile or a private window, and open DevTools before loading the page. Firefox’s documentation spells out why: cookies set by network responses are listed “only for calls that happened while the tool is open” (Storage Inspector). Do not touch the banner yet.
2. List what is stored. In Application → Storage → Cookies, pick the origin. The filter box matches only the cookie’s name or value, so type the name. The Domain and “Expires / Max-Age” columns are the browser’s own record for your site, not a database’s average.
3. Find the response that set it. In the Network panel, type this into the filter box (Network reference):
set-cookie-name:_gaThat shows every request whose response carried a Set-Cookie header for that name. Open a request’s Cookies tab to see the cookies involved, and hover the info icon to see why any was blocked. If the filter comes back empty while the cookie is in the jar, a script wrote it with JavaScript. The document.cookie hook in which script set that cookie names the file responsible.
4. Check the timing. If the cookie is there before you answered the banner, that is the finding that matters. A database entry cannot tell you this. Verifying Consent Mode from the Network tab covers the same method for Google tags, and our Playwright script runs it across a whole site.
5. Then read the vendor’s documentation. For _ga, three sources agree:
Source _ga says
Google, "[GA4] Cookie usage on websites" 2 years · "Used to distinguish users."
Open Cookie Database (CSV) 2 years · "ID used to identify users"
Your browser (Application panel) the actual expiry, domain and flags on your siteA quick console check lists the names that scripts can see:
document.cookie.split('; ').map(c => c.split('=')[0]);It will not list HttpOnly cookies. As Cookiepedia’s own glossary says, that flag “prevents other programs or scripts (like Javascript) from reading the cookie.” The Application panel shows them.
Alternatives, and what each is good for
| Source | Who runs it | Good for | Limits |
|---|---|---|---|
| Cookiepedia | OneTrust | Looking up a common cookie name by hand; searching by site or host | Scripted access blocked by a bot check; OneTrust’s categories; 32% “Unknown”; no values |
| Open Cookie Database | Community project on GitHub | Bulk matching: CSV and JSON, 2,266 entries, 260 wildcard patterns such as _gac_*, an import file for the EDPB tool below; Apache 2.0 |
Much smaller; updated in bursts (last change merged 21 August 2026, the one before in January 2026); its own category scheme |
| Vendor documentation, e.g. Google’s GA4 cookie page | The vendor | The vendor’s own statement of purpose and lifetime for its cookies | One vendor at a time; lists the lifetime the vendor sets, not what browsers keep |
| Browser DevTools | You | What your page actually stored, when, and from which response | Manual; one page and one consent state per run |
| EDPB Website Auditing Tool | Built for the European Data Protection Board | Collecting evidence and reports on a site’s trackers; free software (EUPL 1.2), release 3.0.1 on 28 September 2026 | A desktop app (Electron); its README warns releases are not yet signed |
| CookieInspector (affiliated with ConsentModeHQ) | CookieInspector | Repeatable scans of what loads before and after the banner | A scanner reports what it saw on the pages and in the consent states it tested |
These tools answer different questions, so you usually need more than one. Use a database to put a name to a cookie. Use the browser to see what your own site did. Use the vendor’s documentation to confirm what the cookie is for. The full list of consent and audit tools we reference is on our tools page. If a cookie survives a refusal, see rejecting cookies does not delete them.
A database tells you what a cookie usually is; only your own pages show what they actually set. Scan your site to see what loads before and after the banner with CookieInspector.