Cookiepedia is a lookup dictionary: useful for identifying what a cookie generally is, useless for telling you what your site actually sets, when, and whether that’s compliant. Use a database to name cookies; use a live scan to audit them.
What Cookiepedia actually is
Cookiepedia is OneTrust’s public cookie database — a searchable index of cookie names crowd-collected from scans, each with a rough classification (strictly necessary, performance, functionality, targeting) and the vendor behind it. If you’ve ever Googled a cryptic cookie name like _ga or IDE, you’ve probably landed there. As a dictionary, it’s genuinely handy, and CMPs (OneTrust’s included) lean on databases like it to auto-classify what their scanners find.
Where the database model falls short
- It describes cookies in general, not on your site. The same cookie can be first-party analytics on one site and part of an ad stack on another. A static entry can’t know which one you are.
- Classification is not compliance. Knowing
_fbpis “targeting” tells you nothing about the question regulators and plaintiff firms actually ask: did it fire before consent? That gap is why most cookie audits fail. - Coverage lags reality. New SDK versions, renamed cookies, server-set identifiers and localStorage-based tracking show up on sites long before any database catalogs them.
- No timing, no context, no evidence. A lookup can’t produce the thing you need for a client file or a regulator response: proof of what loaded, in what order, under which consent state.
Dictionary vs. audit: use both, for different jobs
The right mental model: Cookiepedia answers “what is this cookie called elsewhere?” A live scan answers “what does my page do to a fresh visitor?” — launching a real browser, capturing the pre-consent window, interacting with the banner, and diffing what fires after. We compared the approaches in detail in our review of automated cookie scanning methods.
How to check what a site actually sets
Paste the URL into CookieInspector’s free cookie audit tool: in about 30 seconds you get every cookie and tracker the page really sets — classified, timestamped against the consent banner, and exportable as a PDF. No plugin, works on any stack, and it will happily audit a site you don’t control (a client’s, a competitor’s, or the one your CMP vendor swears is configured correctly). Then, when a cryptic name shows up in the report, that’s the moment a dictionary like Cookiepedia earns its keep.
Look up cookies in a database. Audit sites with a scanner. The sites that get demand letters are usually the ones that only ever did the first.