Skip to content
Page Lookout

Classify your own cookies and storage keys

Updated

Page Lookout classifies the cookies and storage keys a consent scan finds. When it does not know one, or you know better for your own sites, you can give your organization’s answer. This page explains what you can set, who can set it, which answer wins, when it applies and where it is marked. The lists a consent scan produces are described in Inventory.

What it is

An organization admin can classify a cookie, by its name or by the start of its name, or a storage key, for all of the organization’s sites or for one site. An entry has a category, a flag for whether the site needs it to work (“essential”), the vendor, and an internal note that is never shown in a finding or a report. For a cookie you can add the domain that must have set it, so a cookie called id on your own site does not silence an id on an advertising domain.

Open Settings, Cookie and storage classifications to see them all, or choose Classify… on a row of the Inventory.

Who can use it

Organization admins add, change and remove classifications in the app. Page Lookout’s own team can do the same on an organization’s behalf through platform access; that is audited and shown as done by Page Lookout. Members can read them and see the marking. API keys can read them and cannot change them.

What wins

When a scan looks up a cookie or a storage key, the first of these that knows it answers:

  1. your organization’s classifications (a site’s own first, then the ones for all sites);
  2. Page Lookout’s own knowledge base;
  3. the built-in tables;
  4. the Open Cookie Database, for cookie names only.

A classification for one site beats one for all sites, and the most specific match wins: an exact name before a “starts with”, and a longer start before a shorter one.

When it applies

From each site’s next scan. Scans you have already run are not changed, and neither are their findings. Until the next scan the Inventory shows Applies from the next scan next to the row, and the dialog offers Scan now.

Any category is allowed

You can classify any cookie or storage key in any category. Items you mark essential are not reported: scans stop raising the optional-cookie findings for them and stop listing them as unclassified. The dialog says so before you save.

It is always marked

Wherever your classification decides what a scan reports about an item, it is marked Classified by your organization, and it is never presented as Page Lookout’s own classification. (An item you mark essential leaves no finding, so there is nothing to mark there; the Inventory row, the CSV and the audit log still say it was yours.) You will see the marking:

  • in findings, in the Inventory, and in the CSV files, with who changed the classification last and when;
  • in the PDF report of scans finished since 20 October 2026, as a count: how many cookies and storage keys of the scan your organization classified, how many findings rely on those classifications, and the version of the set. The report does not name a person or a date; those are in the dashboard, the CSV and the audit log;
  • in the audit log, which records every addition, change and removal.

Comparing scans

When a site’s classifications change, the first scan afterwards is compared with the one before it in a cautious way: consent findings that appear are not reported as new, those that disappear are not reported as resolved, no alert is raised for them, and the run shows a note saying why. The scan after that compares as usual.

Limits

An organization can hold up to 500 classifications. The ones that apply to a single site must fit in 64 KiB. If they do not, the dialog names the site that is full (or says “every site”), asks you to remove some classifications, and suggests replacing several with one “starts with” entry. Classifications are added one at a time.

Anonymous suggestions

Each classification is also sent to Page Lookout as an anonymous suggestion: only the name, whether it is a cookie or a storage key, how it matches, the category you chose and whether you marked it essential, counted per organization. Never your organization, your sites, the cookie domain, the vendor or the note. Page Lookout’s team sees a suggestion in its Suggestions view only once two organizations have made it. It may adopt a suggestion into Page Lookout’s own knowledge base, which then applies to everyone; your own classification still wins for you. Removing yours withdraws your suggestion. The team can still see an individual entry through the audit log and through platform access to your organization, and both are recorded.

In the API and the CSV files

The API reads your classifications (consent-classifications, one entry by its id, and the set a site’s next scan would use) and adds organizationClassification to inventory rows and findings. The cookie and storage-key CSV files end with five columns: Organization classification, Organization category, Organization essential, Organization classified by and Organization classified on. See the API reference and the changelog for version 1.2.0, and API and webhooks for the short map.

What it does not say

Classifying a cookie records your organization’s answer about what it is for. Page Lookout does not review it, and it is not a statement that a cookie is allowed or not allowed, or that a site meets any rule.