The terms “cookie scanner"and"automatic detection” frequently appear in CMP feature lists. They can create the impression that they describe two variations of the same feature.
They do not. A scanner primarily observes a website and builds an inventory. Automatic detection such as the mechanism used by tarteaucitron Pro operates while the page is loading so it can recognize a service and potentially act before that service runs.
Both approaches can be useful, but they solve different problems.
What does a cookie scanner do?
A scanner generally crawls website pages in a similar way to an automated browser. It observes cookies, scripts and other technologies it encounters and builds an inventory.
Depending on the solution, detected elements may then be automatically categorized, associated with a provider or added to a cookie declaration.
This is particularly useful for discovering what exists on a website that is not fully understood.
A company may, for example, discover that a WordPress plugin loads an external service that had never been identified when the CMP was initially configured.
A scan is a snapshot of the website
The main limitation comes from the nature of scanning itself. A scanner can only observe what it encounters during its crawl.
A service loaded only on an order confirmation page, after a user logs in or following a particular interaction may never appear during the scan.
The same applies to scripts triggered by a specific condition, marketing campaign or Google Tag Manager configuration.
A scanner therefore provides an extremely useful inventory, but that inventory necessarily depends on the pages and scenarios it actually explored.
Automatic detection during loading solves another problem
tarteaucitron Pro automatic detection operates directly within the page being visited.
JavaScript observes elements attempting to load and recognizes supported services using known rules. It can, for example, identify certain URLs or resources belonging to Google Analytics, Facebook, YouTube or other services integrated with tarteaucitron.
When tarteaucitron loads early enough, this detection can intervene before the relevant service actually loads.
The goal is therefore not simply to answer “what exists on this website?"but"what is trying to load right now on this page?”.
Detecting a service is not simply detecting a cookie
The expression “cookie scanner” is itself somewhat reductive. Consent issues are not limited to small files stored in the browser.
A third-party service may transmit data as soon as a script or iframe loads, before considering any cookies it subsequently stores.
For a CMP, identifying the service and preventing its initial request can therefore be more important than waiting for a cookie to appear before noticing its existence.
Rules applying to tracking technologies are not limited to cookies either.
A scanner does not necessarily block what it finds
This distinction is particularly important when comparing CMPs.
A solution may produce an excellent report showing that Google Analytics, Meta Pixel and various cookies are present on a website. This does not automatically mean it prevents those technologies from operating before consent.
Inventory is one step. Blocking is another.
After installing a CMP, I therefore always recommend checking network requests directly with DevTools.
Automatic detection is not magic either
The opposite situation deserves the same caution. A CMP offering automatic detection cannot arbitrarily recognize every script that exists on the Internet.
It operates using rules that identify services it knows.
With tarteaucitron, the service list and detection rules are therefore maintained over time. When a provider changes its integration, domains or behaviour, those rules may need to evolve.
An unknown service or a highly unusual integration may not be automatically detected.
Loading order remains decisive
Even the best detection rule cannot travel back in time.
If Google Analytics has already executed its JavaScript and sent a request before the CMP loads, subsequently detecting its presence cannot undo that request.
This is why the tarteaucitron Pro marker should be placed as high as possible in the <head>, before the services it needs to control.
I dedicated an entire article to the importance of loading order because this simple rule explains a large number of incorrect integrations.
Manual mode can avoid the need for scanning too
tarteaucitron open source takes another approach.
The developer normally knows which services are being installed. For example, the GA4 tag directly present on the website is removed and the GA4 service is instead declared to tarteaucitron.
The CMP then becomes the point through which the service is loaded after consent.
This method requires more work, but it is very explicit: there is no need to automatically discover a script that the developer has just declared.
Scanning remains very useful for complex websites
I therefore do not consider scanners useless. On an old website, a WordPress installation containing many plugins or a project that has involved several providers, an automated inventory can reveal surprises.
It can also serve as a regular monitoring tool. If a new tracker appears following an update or marketing change, scanning can help identify it.
It simply does not perform the same function as a mechanism responsible for preventing that tracker from operating before consent.
Scan, detect, block and verify
I would therefore distinguish four operations.
- Scanning builds an inventory of technologies encountered on the website.
- Detection identifies a service when it appears on the page.
- Blocking prevents that service from operating until the required conditions are met.
- Verification confirms in the browser that the expected result is actually achieved.
A CMP may combine several of these functions, but grouping them all under the term “automatic detection” easily creates confusion.
The best tool mainly depends on the website
For a simple website where the developer knows exactly which five external services are being used, permanent scanning is not necessarily essential.
For a large website that changes regularly, scanning can provide very useful visibility.
In both cases, the final problem remains the same: once a service has been identified, it is still necessary to ensure that it actually respects the visitor’s choice.
A perfect inventory listing a tracker that already executed before consent is still only a very good inventory of a problem.
