Most cookie audits rely on automated scanners that visit your homepage, find a few cookies, and generate a report. Those scanners miss a lot: pixels that only fire after login, scripts loaded dynamically by GTM, trackers set by third-party iframes, and cookies dropped on specific user journeys like checkout or form submission.
A HAR (HTTP Archive) analysis captures every network request your browser makes during a real user session. It’s the most thorough way to find every cookie and tracker on your site.
What Is a HAR File?
A HAR file is a JSON log of all HTTP requests and responses made by your browser. It captures:
- Every script, pixel, and API call loaded by the page
- All cookies set and sent (including HttpOnly cookies invisible to JavaScript)
- Request/response headers showing tracking parameters
- Timing data showing when each request fires relative to user actions
Unlike automated scanners, a HAR analysis captures what actually happens during real user behavior: page loads, form submissions, scrolls, clicks, and navigation between pages.
Step 1: Record HAR Files
Open Chrome DevTools (F12), go to the Network tab, and check “Preserve log” so requests persist across page navigations. Then:
- Clear state: Clear all cookies and site data for your domain (Application > Clear site data)
- Record the consent-denied journey: Load the site, do NOT accept the cookie banner, navigate through 3-4 pages, and submit a form. Save this HAR file as “denied.har”
- Clear state again
- Record the consent-granted journey: Load the site, accept all cookies, navigate the same pages, submit the same form. Save as “granted.har”
Right-click in the Network tab > Save all as HAR with content.
Step 2: Analyze the HAR Files
Open each HAR file in a HAR viewer (Google’s HAR Analyzer or the DevTools HAR import). Look for:
In the denied.har (consent not granted):
- Any requests to Google Analytics, Google Ads, Meta, LinkedIn, or other ad/analytics platforms. These should NOT be present if consent gating works correctly.
- Cookies set by third-party domains. Filter the cookies column for domains other than your own.
- Any
collectorpixelendpoints being hit. These are tracking calls.
In the granted.har (consent granted):
- All expected tracking calls should be present: GA4 collect requests, Google Ads conversion pixels, etc.
- The consent parameters in GA4 requests should show
gcs=G111(all granted) notgcs=G100(default denied). - Third-party cookies from analytics and marketing platforms should appear.
Step 3: Build a Cookie Inventory
From the HAR analysis, create a spreadsheet with:
| Cookie Name | Domain | Category | Purpose | Duration | Consent Required |
|---|---|---|---|---|---|
| _ga | .example.com | Analytics | GA4 client ID | 2 years | Yes |
| _gcl_aw | .example.com | Marketing | Google Ads click ID | 90 days | Yes |
| _fbp | .example.com | Marketing | Meta Pixel browser ID | 3 months | Yes |
| PHPSESSID | example.com | Essential | Server session | Session | No |
This inventory is what your cookie policy page should reflect, and what your CMP should be configured to manage.
Step 4: Verify Consent Gating
Compare your two HAR files side by side. The key question: do tracking requests appear in the denied HAR that shouldn’t be there?
Common violations we find:
- GA4 firing before consent: Usually because the GA4 tag in GTM doesn’t have consent settings configured
- Meta Pixel loading via hardcoded script: The pixel was added directly to the theme/header instead of through GTM, bypassing consent gating entirely
- HubSpot tracking code ignoring consent: HubSpot’s default embed doesn’t respect Google Consent Mode unless explicitly configured
- Chat widgets setting cookies immediately: Intercom, Drift, and similar tools often drop tracking cookies on load regardless of consent
Step 5: Configure Your CMP
Your consent management platform needs to know about every cookie and tracker you found. Configure each one into the right category:
- Essential: Session cookies, security tokens, shopping cart. Always active, no consent required.
- Analytics: GA4, Hotjar, Clarity. Requires analytics consent.
- Marketing: Google Ads, Meta Pixel, LinkedIn Insight Tag, retargeting cookies. Requires marketing consent.
- Preferences: Language selection, UI preferences, non-essential personalization. Requires preference consent.
Tools like CookieBeam, Cookiebot, and Osano can auto-scan for known cookies, but HAR analysis catches the ones scanners miss: dynamically loaded scripts, event-triggered pixels, and cookies set by iframes.
Need a Professional Audit?
A full cookie audit with HAR analysis, CMP configuration, and consent verification takes specialized tools and knowledge of how each tracking platform interacts with consent mode.
Our Consent & Privacy Compliance service includes HAR-level cookie audits, CMP setup, GTM consent gating, and Consent Mode V2 implementation with network-level verification evidence.
