Each cookie classified (necessary/analytics/marketing) with documented purpose

GDPR Art. 13 and ePrivacy Art. 5(3) require that users be informed of every cookie set by the application, its purpose, and its retention period before consent is obtained. An incomplete cookie register means your consent banner is legally invalid — users cannot give informed consent to cookies they don't know exist. CCPA §1798.120 also requires disclosure of the categories of data collected through tracking technologies. Common AI-built apps add Facebook Pixel, Google Analytics, and Hotjar during different sessions and never update the consent configuration, leaving undisclosed cookies firing on every page load. ISO-27001:2022 A.5.34 requires organizations to maintain records of processing activities that include this level of classification.

Maintain a typed cookie registry in your codebase as the single source of truth for both the consent banner and the privacy policy cookie section.

// lib/cookies.ts — cookie registry
export const COOKIES = [
  {
    name: 'session',
    type: 'necessary' as const,
    purpose: 'Maintains authenticated session state',
    expiry: 'Session',
    thirdParty: false,
  },
  {
    name: '_ga, _ga_XXXXXXXX',
    type: 'analytics' as const,
    purpose: 'Google Analytics — pseudonymous page view and behavior tracking',
    expiry: '2 years',
    thirdParty: true,
    provider: 'Google LLC',
  },
  {
    name: '_fbp',
    type: 'marketing' as const,
    purpose: 'Facebook Pixel — conversion tracking and ad attribution',
    expiry: '90 days',
    thirdParty: true,
    provider: 'Meta Platforms Inc.',
  },
] as const

Import this registry into your consent banner component to render the per-category toggle labels, and mirror it verbatim in your privacy policy's cookie table. Every time you add a third-party script, add its cookies here first.