Every cookie and similar technology used is documented and classified

ePrivacy Art. 5(3) requires informed consent before accessing device storage — users cannot give informed consent to cookies they don't know exist. GDPR Art. 13 requires controllers to disclose the categories of data processed and the recipients, which for cookie-based tracking means naming every third-party tool and the cookies it sets. CCPA §1798.135 requires disclosure of the categories of personal information collected and shared. An undocumented cookie from Hotjar or a Facebook Pixel is not a minor oversight — it is an undisclosed collection of behavioral data shared with a third-party processor outside the scope of any consent obtained.

Create a central COOKIE_REGISTRY constant and drive both the consent banner and the cookie policy page from it. Add an entry every time a new third-party script is added to the project.

// src/lib/cookies/registry.ts
export const COOKIE_REGISTRY: CookieEntry[] = [
  {
    name: 'session',
    category: 'essential',
    purpose: 'Maintains authenticated user session.',
    expiry: 'Session',
    provider: 'First party',
    thirdParty: false,
  },
  {
    name: '_ga, _ga_XXXXXXXX',
    category: 'analytics',
    purpose: 'Google Analytics — tracks page views pseudonymously.',
    expiry: '2 years',
    provider: 'Google LLC',
    thirdParty: true,
  },
  {
    name: '_fbp',
    category: 'marketing',
    purpose: 'Facebook Pixel — ad conversion attribution.',
    expiry: '90 days',
    provider: 'Meta Platforms Inc.',
    thirdParty: true,
  },
]

Run a comparison between this registry and document.cookie values in staging to detect gaps before shipping new third-party integrations.