No cookies set that are not in the classification and consent mechanism

ePrivacy Art. 5(3) prohibits storing information on a device for any purpose not disclosed at the time of consent. GDPR Art. 5(1)(a)'s transparency principle and CWE-359 (exposure of private information) both apply when cookies are set that users have not been told about. Google Tag Manager is a common source of shadow cookies: a new tag added to the GTM container can set cookies without any code change, making code review an insufficient audit method. A/B testing and session recording tools are frequently added by marketing teams without coordinating with the consent setup, creating undisclosed collection that continues silently.

Validate at runtime that every cookie present in document.cookie has a corresponding registry entry. Run this check in development or CI to catch gaps before they reach production.

// src/lib/cookie-audit.ts — dev/CI only
import { COOKIE_REGISTRY } from './cookies/registry'

export function auditCookies(): void {
  const setCookies = document.cookie
    .split(';')
    .map(c => c.trim().split('=')[0])
    .filter(Boolean)
  const registered = COOKIE_REGISTRY.map(e => e.name)
  const unclassified = setCookies.filter(
    c => !registered.some(r => c.startsWith(r.replace('*', '')))
  )
  if (unclassified.length > 0) {
    console.warn('[cookie-audit] Unclassified cookies found:', unclassified)
  }
}

For GTM, audit the container directly: GTM → Admin → Container → Tags. Every tag that fires on All Pages and sets cookies must have a corresponding registry entry.