Consent Inventory

A free bookmarklet that lists, in the page you have open, the script-readable cookies, the localStorage and sessionStorage keys, and the hosts loaded by scripts, iframes, images and stylesheets. Useful to check what loads before a visitor has consented (GDPR; Swiss nFADP).

No data is sent: everything runs in your browser; the result can be copied as JSON.

Install

Drag this button to your bookmarks bar:

Consent Inventory

Code: bookmarklet.txt · readable source: bookmarklet.js · GitHub repository (MIT).

Try it on a synthetic page

Open the synthetic test page: it references fictional hosts under the reserved .invalid domain (they never load) and sets one fake cookie and one fake storage key. Click the bookmarklet and compare with the expected inventory printed on that page.

"Pre-consent" procedure

Open the page in a private window.
Do not click the banner.
Run the bookmarklet and copy the JSON.

Host classification rule

Each loaded host is classed as same host, subdomain of the page host or other host — ownership undetermined. The tool does not guess a "base domain": evil.co.uk stays distinct from shop.co.uk, and a related host is listed as other rather than wrongly attached.

Feedback and support

Feedback is voluntary and goes through GitHub: open an issue (bug report or feedback form). See SUPPORT.md (best effort, no guaranteed response time).

Do not send private data. Issues are public. Never paste the JSON output of a non-public page, cookie values, session identifiers, user data or a client's site name without permission. Reproduce with a synthetic example instead, like the test page above.

Limits

HttpOnly cookies are not visible to scripts; network requests not tied to a DOM element are not visible either.
A technical inventory tool, not legal advice.

Horizon — personal project. MIT licence. No cookies, no trackers on this page.