Cookie Scans

SL-03

A crawler that visits our own surfaces the way a citizen would — with a clean browser, no consent given — and records everything that gets set anyway. Scanning with cookies already accepted tells you nothing, which is why the crawl always starts cold.

DischargesS.6 S.8(4)

14 pre-consent cookies observed across the last three scans

Counted with a cold browser and no interaction with the banner. Some of these are legitimately necessary — session, CSRF, and the cookie-choice cookie itself. The rest are the finding.

Scans

Pages crawled

1,542

New cookies found

Pre-consent

Third-party hosts

Scan history

aiventuretech.ioWebsite

CKS-2026-0041 · completed 4 days ago

completed

Pages: 1,284
Cookies: 11
New: 1
Unapproved: 4
Pre-consent: 6

Third-party hosts contacted

.google-analytics.com.youtube.comcdn.partner-widget.example.doubleclick.net

Review what it found

scholarships.aiventuretech.ioWebsite

CKS-2026-0042 · completed 4 days ago

completed

Pages: 212
Cookies: 8
New: 3
Unapproved: 4
Pre-consent: 5

Third-party hosts contacted

.facebook.com.doubleclick.net.google-analytics.com

Review what it found

Citizen Services mobile app (Android 4.2.1)Mobile app

CKS-2026-0043 · completed 3 days ago

completed

Pages: 46
Cookies: 5
New: 1
Unapproved: 2
Pre-consent: 3

Third-party hosts contacted

analytics-sdk.examplecrashlytics.example

Review what it found

pension.aiventuretech.ioWebsite

CKS-2026-0044 · started yesterday

running

62% · 418 pages

Pages: 418
Cookies: 6
New: 0
Unapproved: 0
Pre-consent: 3

Service kiosks (District North)Kiosk

CKS-2026-0045 · started yesterday

queued

Waiting for a crawler slot. Kiosk surfaces are scanned out of service hours so a citizen is never queued behind a crawl.

How the crawl works

Four choices that determine whether a scan tells you anything true.

A clean profile every time
No stored consent, no prior cookies. Otherwise the crawler sees the permitted state rather than the default one.
Banner deliberately not answered
The whole question is what gets set before a choice is made.
Authenticated and unauthenticated paths
Trackers behind a login are the ones nobody audits, and the pages behind a login hold the most personal data.
Mobile SDKs counted as trackers
An advertising identifier read at app launch is the same obligation as a pre-consent cookie. The absence of a browser changes nothing.

Last full sweep of all surfaces: 03 August 2026. The retainer commits to a weekly crawl of public pages and a monthly crawl behind authentication.