Almost every team we meet believes cookie management is solved, because there is a banner on the site. The banner is the smallest part of the job. What matters is whether the list behind it matches what the browser actually stores, and on most sites, it does not.
The banner is a promise about software you do not control
A consent banner tells a visitor that nothing non-essential runs until they say yes. Keeping that promise means every tag, pixel, embed and SDK on the page obeys it, including the ones a growth experiment added last Thursday and the ones a vendor loads inside its own script.
That is why the honest version of cookie management starts with observation, not configuration. You cannot govern what you have not measured, and the page is the only source of truth about what the page does.
What a real inventory contains
An inventory is not a table copied from a template. For each cookie or storage item you need the facts a user, an auditor or an enterprise buyer will ask for:
Consent that decays
Even a correct inventory rots. Sites add a chat widget, a heatmap trial, an A/B tool; each one arrives with its own storage and often its own third parties. Six months later the cookie page is a historical document and nobody noticed, because nothing on the site breaks when it goes stale.
The fix is not more discipline. It is a scan that runs on a schedule, diffs against the declared list and raises the difference as a change to approve, the same way a code review works.
What good looks like
Teams that get this right treat the cookie page as generated output, not a document. The registry is the source; the public page, the banner categories and the vendor list are rendered from it. When a new cookie appears, someone approves or blocks it, and the page updates itself.
That is the difference between managing cookies and displaying a banner, and it is visible from the outside, which is exactly how regulators and buyers look at you.
Find the cookies your banner does not declare.
Komploop scans your public pages, lists every cookie and vendor it observes, and shows exactly which ones fire before consent.