Skip to content
Page Lookout

Inventory

Updated

The Inventory lists the third parties, cookies and stored keys that a consent scan saw on your site. This page explains what each list contains, how to read a row, where the classifications come from and what the Inventory does not say.

What it is

The consent scan opens the pages it selects for consent checks, which are the site’s consent-relevant pages, at most 100 per scan and not every page of the site. It opens each page three ways: before any choice on the consent banner, after Reject all and after Accept all. For each it records which third-party domains the page contacted, which cookies are present and which local and session storage keys exist.

The inventory merges that over the pages of one scan into three lists:

  • Trackers: third-party domains, with the vendor and category when Page Lookout’s tables name them, how many requests they received, and whether the page markup or a script requested them.
  • Cookies: by name and domain, with whether they are first or third party, who set them, how long they live and the category when it is known.
  • Storage: local and session storage keys, by origin.

A row that is absent therefore means “not seen on those pages”, not “not on the site”.

Page Lookout records names, never values: no cookie value, no stored value and no URL path or query string.

Where to find it

  • A site’s Inventory tab is shown for sites whose scans include the consent module. It shows one scan at a time, with a header that says which scan, how many pages it observed, which classification tables were used and what changed since the scan before. Older scans are in the scan picker.
  • The organization’s Inventory screen (in the sidebar) shows the trackers and the cookies merged over the latest inventory of every site you can see. A Sites column says on how many sites each row was seen and names some of them, each a link to that site’s own tab. The line above the table says how many of your sites have an inventory, and the lists are made of those. The filters can narrow the sites by choice or by tag.
  • Download CSV is on both screens. The file holds the rows the current filters match. The same data can be read through the API, see API and webhooks.

How to read a row

  • Seen before a choice, after Reject all, after Accept all. A tick is a fact the scan established. A minus on a site’s tab means “not seen” in a scenario that ran on every observed page. A dashed circle means “not checked”: the scenario did not run on any page, so its absence says nothing. A minus with “Not seen on 5 of 8 pages” speaks only for the pages the scenario ran on. On the organization screen a minus means that no site’s latest scan saw the row in that scenario, and each site’s own tab says on how many pages the scenario ran.
  • New is a comparison with the previous inventory of the same site. A site’s first inventory has nothing to compare with, so nothing in it is marked new: an unmarked row is “not new” or “unknown”, and the screen says which when it matters. Across sites, “New on 2 sites” counts the sites where the row was not in that site’s previous inventory.
  • Unclassified means none of the classification tables names the row yet. It describes the tables, not the row.
  • Owned by … under “Unclassified” (third-party domains only) names the company that owns a domain serving several purposes, for example a search engine’s domain that also hosts sign-in, maps and advertising. The scan knows whose domain it is, but a request to it does not say which of those purposes it had, so Page Lookout leaves the row Unclassified rather than guess a category. The owner is also in the CSV’s Owner column. “Unclassified” without an owner means no table names the domain at all; “Unclassified, owned by Google” means the domain is known and the purpose is not. An owner is never a category, and a row that is classified shows its vendor instead.
  • Community list. A cookie with this note was classified by the Open Cookie Database rather than by a table Page Lookout reviewed (see below). Findings that depend on it are marked as needing a person to verify them.
  • Partial inventories say so. Rows cut to keep one page’s record small, rows left out because they could not be recorded safely, and a cap on one scan’s inventory are all counted in a notice on the site’s tab. When two scans visited different pages, “new” and “gone” may reflect that rather than a change on the site.

How rows are classified

A row’s vendor and category come from the first of these that names it:

  1. Page Lookout’s reviewed classifications. Rows Page Lookout publishes for names it has reviewed. These win over everything below.
  2. The built-in table. The names and domains Page Lookout ships, each checked against the vendor’s own documentation.
  3. The Open Cookie Database. A public, community-maintained list of cookie names, consulted last. It answers cookie names only: it never classifies a domain or a storage key.

Your own organization can also classify a cookie or a storage key; that answer comes first and is always marked as yours. See Classify your own cookies and storage keys.

The header of a site’s Inventory lists every table the scan used, with its version. Versions are dates, so what you see differs by release. A row that two tables name gets the answer of the one earlier in the list, and the other is not shown. Cookie rows classified by the community list carry the note “Community list” and the tooltip “Classified by the Open Cookie Database, a community list”.

Credit. The Open Cookie Database is an open project maintained by its community and is used under the Apache License 2.0. Page Lookout ships the list unmodified, with its licence, and maps its categories to its own.

How much to trust it. Community entries can be wrong or too general for one site, so an answer that only the Open Cookie Database gave is reported with lower confidence, and the cookie findings that depend on it are marked as needing a person to verify them. If a classification looks wrong for your purposes, tell us at office@natcroft.com. Page Lookout’s reviewed classifications take precedence over the community list.

Two numbers near 13 months appear in the product, and they are not the same:

  • The Inventory’s lifetime filter groups cookies into buckets. “13 months or more” starts at 395 days.
  • The two cookie lifetime findings apply to a cookie that outlives 397 days, so from 398 days, whatever its category. A cookie of 395 days is in the “13 months or more” bucket and has no lifetime finding.

The 13-month figure is commonly drawn from guidance by a European data-protection authority. Page Lookout does not treat it as a rule, and its findings do not cite any regulation. They state how long the cookie lasts and when the scan saw it. A scan cannot see how long a site keeps the data a cookie refers to, so that limit is outside what the findings cover. Browsers cap the lifetime they accept for a cookie set by a script (Chrome: 400 days), so a cookie that a site tries to make last for years may show as roughly 400 days.

The approved list

An organization can say which third parties it expects. While that list is on, the Inventory has an Approved list column on its third-party tables and two extra columns at the end of their CSV files, and scans report the third parties that are not on the list as findings. See Approved third parties. The column is judged against the list as it is when you open the page, and the findings when a scan ends.

What it does not say

Page Lookout reports what the scan observed. The Inventory does not say that a tracker or a cookie is allowed or not allowed, that a category is the right one for a purpose, or that a site meets any rule. Whether what was seen is acceptable is a judgement about a specific site, purpose and jurisdiction, and a scanner does not make it. Nothing in the product says otherwise.