A website storage inventory should describe what the browser actually stores, not just what a tag-manager list says should happen. Review cookies, local storage, session storage, IndexedDB, caches, service workers, embedded frames, and third-party resources across representative pages and consent states. Treat the inventory as a technical record that supports privacy review; it is not a substitute for jurisdiction-specific legal advice.

Define the fields before scanning

For every item, record its name or key, storage type, first- or third-party origin, domain and path where relevant, owner, source script or feature, purpose, data category, creation trigger, duration or expiry, access behavior, recipient, consent category, and removal method. Add evidence such as the observed page, browser profile, date, and test state. Do not copy live session tokens or sensitive values into the audit workbook.

The Chrome DevTools Application panel exposes cookies, local and session storage, IndexedDB, shared storage, and cache storage by origin. Use that view to inspect observed state, but repeat tests in a clean browser profile because existing sessions and extensions can change the result.

Test representative states

  1. Clear site data and load the home page before interacting with a consent control.
  2. Repeat after rejecting optional storage, accepting selected categories, and accepting all categories.
  3. Test login, search, checkout, embedded video, chat, analytics, advertising, and support flows that load additional scripts.
  4. Navigate between pages and subdomains, then close and reopen the browser to distinguish session behavior from persistence.
  5. Inspect network requests as well as stored entries; a tag can transmit data even when its local footprint is small.
  6. Repeat on mobile and another major browser when the site supports them.

Include technologies beyond cookies

The UK Information Commissioner's Office explains that storage and access technologies include cookies, web storage, tracking pixels, scripts, tags, link decoration, and fingerprinting, and that the relevant rules depend on storage or access and purpose rather than only a first-party or third-party label. See the ICO storage and access technology guidance. Applicability varies by location and use, so route compliance decisions to qualified counsel or the responsible privacy owner.

The HTML Standard's web-storage section distinguishes per-window session storage from storage designed to persist beyond the current session. That difference makes duration testing important: a key named `session` is not proof that the browser treats it as session storage, and a persistent entry should have a documented cleanup path.

Reconcile and maintain

Compare observed items with the privacy notice, consent interface, tag-manager configuration, vendor contracts, and application code. Investigate unknown owners, undocumented purposes, inconsistent expiry, items set before the expected consent state, and storage that remains after withdrawal. Remove obsolete items through normal development and change control, then retest. Review the inventory after releases, marketing-tag changes, payment or chat integrations, consent-platform changes, and at a scheduled interval. The finished inventory should let another reviewer reproduce where each item appears and why it is still needed.

Sources

  1. Application Panel Overview — Chrome for Developers
  2. What Are Storage and Access Technologies? — Information Commissioner's Office, April 29, 2026
  3. HTML Standard: Web Storage — WHATWG

Related reading