This guide is for anyone who wants to see what a site stores in their browser: a curious visitor, a marketer checking a new tag, or a site owner who wants to know whether the consent banner really works. If you need the full compliance method (inventory, classification, dated report), read our website cookie audit guide. Here we stay practical: where to click in each browser, how to read what you see, and how to find out who set each cookie.
Why check the cookies a website uses?
As a visitor. You see who can follow you from one visit to the next. Under Article 5(3) of the ePrivacy Directive, a site may only store non-essential information on your device after you agree. Checking the cookie list is the simplest way to see whether a "Reject all" click is respected.
As a site owner. Your banner and your cookie policy must describe what your pages really do. Marketing tags, plugins, chat widgets and embedded videos regularly add cookies that nobody declared.
As a developer. Cookie lists help debug login sessions, cross-site issues and SameSite warnings.
How to check cookies on a website in Chrome
With developer tools
- Open the page you want to inspect.
- Press F12 (Windows, Linux) or Cmd + Option + I (Mac). You can also right-click anywhere on the page and choose "Inspect".
- Open the Application tab. If you do not see it, click the double arrow at the top of the panel.
- In the left column, under Storage, expand Cookies and click the site's address.
The table lists every cookie available to the page. The Domain column tells you whether a cookie belongs to the site itself or to another domain, a third party such as an analytics or advertising provider. Click a row to see its full value at the bottom of the panel.
Without developer tools
Click the icon to the left of the address bar (site information), then open the cookies and site data section. Chrome shows which sites have stored data during the visit and lets you delete it. It is quick, but you do not see names or expiry dates. For anything more than a glance, use the developer tools.
How to see cookies in Firefox
- Press F12 or Cmd + Option + I.
- Open the Storage tab.
- Expand Cookies and click the site's address.
Firefox shows the same columns as Chrome. Keep in mind that Firefox's Total Cookie Protection, enabled by default for all users since 2022, stores third-party cookies in a separate jar for each site. A third-party cookie you see on one site cannot be read on another one.
How to see cookies in Safari
Safari hides its developer tools by default.
- Open Safari > Settings > Advanced and tick "Show features for web developers" (on older versions: "Show Develop menu in menu bar").
- Open the page, then Develop > Show Web Inspector (Cmd + Option + I).
- Open the Storage tab and click Cookies.
Safari blocks third-party cookies by default through Intelligent Tracking Prevention, so you often see fewer cookies than in Chrome. If you are checking your own site, test in Chrome too: it shows what most visitors' browsers accept. Safari > Settings > Privacy > Manage Website Data lists the sites that stored data on your Mac, but not the individual cookies.
How to see cookies in Microsoft Edge
Edge uses the same engine as Chrome, so the steps are the same: F12, Application tab, Storage > Cookies, then the site's address.
How to check cookies on a phone
Mobile browsers have no built-in developer tools. On an iPhone, the Safari settings (Advanced > Website Data) list the sites that stored data. In Chrome for Android, Settings > Site settings > All sites does the same. Neither shows cookie names. To inspect the mobile version of a page, open it on a computer and use the device toolbar in Chrome's developer tools, or connect the phone and use remote debugging.
How to read the cookie list
Each row is one cookie. The columns that matter:
- Name and Value: the identifier and its content, often a random string.
- Domain: who the cookie belongs to. A domain that is not the site you visit means a third-party cookie.
- Expires / Max-Age: when the browser deletes it. "Session" means it disappears when the browser closes. A date months or years away means a persistent cookie, often used for tracking.
- HttpOnly: the cookie is invisible to JavaScript. That is why typing
document.cookiein the console shows fewer cookies than the table. - Secure and SameSite: security attributes that control when the cookie is sent.
Look at expiry dates closely. The CNIL considers that cookies requiring consent should not last more than 13 months: our guide to cookie retention periods explains the rule.
How to tell which service set a cookie
Most cookies follow a naming pattern you can recognise:
- _ga and _ga_ followed by an ID: Google Analytics 4 (see the _ga, _gid and _gat cookies explained).
- _gcl_au: Google Ads conversion linker.
- _fbp and _fbc: Meta Pixel.
- _ttp: TikTok Pixel.
- bcookie, lidc, li_gc: LinkedIn.
- _hjSessionUser_: Hotjar.
- hubspotutk, __hstc: HubSpot.
- _clck, _clsk: Microsoft Clarity.
- PHPSESSID, JSESSIONID: technical session cookies set by the server.
For an unknown name, search it in quotes, then check the Domain column. To find the exact request that created it, open the Network tab, reload the page, click the requests to the domain in question and look for a Set-Cookie line in the response headers.
Cookies are not the only trackers
The same panel shows Local storage, Session storage and IndexedDB. Scripts use them to store identifiers that work like cookies. Tracking pixels and fingerprinting scripts store nothing visible but still send data: you see them in the Network tab, as requests to domains such as facebook.com or analytics.google.com. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) confirm that the consent rule covers these techniques too, not only cookies.
Check what a site sets before and after consent
This is the most useful test, and it takes five minutes:
- Open a private window, so no existing cookies interfere.
- Open the developer tools first, then load the page.
- Do not touch the banner. List the cookies: only strictly necessary ones should appear, such as a session or load-balancing cookie.
- Click "Reject all", reload and visit two or three pages. No analytics or advertising cookie (_ga, _fbp, _gcl_au) should appear.
- Close the window, open a new private one and click "Accept all". The tags should now set their cookies.
If analytics or advertising cookies appear at step 3 or 4, the banner displays a choice but does not block anything.
Checking page by page is slow. Check in 30 seconds which cookies your site sets with the free cookie scanner: it opens your page in a real browser and lists every cookie, storage entry and third-party script, with the service behind each one.
Online tools to see a website's cookies
FlowConsent's free scanner. It returns a report in 1 to 3 minutes with a privacy score out of 100, each service identified and classified, and a split between services that need consent and those that are technically essential.
Other vendors' checkers. CookieYes (Cookieserve), Cookie-Script and Cookiebot offer free online checkers. They are useful for a first list; check whether they test the page after a refusal or only list what they find.
CookieViz. A free, open-source tool published by the CNIL that shows in real time the cookies and third-party requests while you browse.
Browser extensions. Cookie-Editor and similar extensions display, export and edit the cookies of the current tab.
No scan sees everything: logged-in areas, cookies set after a scroll or a click, content that changes by country. Combine a scanner with the manual check above, and keep dated screenshots or reports: they support your proof of cookie consent if a regulator asks.
How FlowConsent handles cookie checks
FlowConsent scans your site automatically and lists the services it finds, so the banner and the cookie declaration match what your pages load. Scripts that need consent are blocked before consent, and Google Consent Mode v2 is built in. The compliance verification loads your pages while refusing consent and lists anything that still runs: the same test as above, automated. Proof of consent can be exported at any time and data is hosted in Europe. Installation takes about ten minutes on Webflow, WordPress, Shopify, Wix, Framer or through GTM. FlowConsent is free up to 25,000 sessions per month, then Pro costs €14.99 per month for up to 100,000 sessions.