Cookie declaration table: generating and embedding it

Most cookie-consent rules expect you to publish a plain-language list of every cookie your site sets, who sets it, and why — typically on your privacy or cookie policy page. Writing and maintaining that list by hand goes stale the moment a marketing script changes. Cookie Munch generates the cookie declaration table for you from your scanner results and can publish it as a self-updating widget you drop straight into your policy page — no manual re-publishing when your cookies change.

What it's for

The declaration table is the human-readable face of your scan data: instead of raw cookie names, visitors (and regulators) see a grouped, plain-English breakdown — necessary cookies first, then preferences, statistics, marketing, and anything still unclassified — each row naming the cookie, its provider, its purpose, and how long it lives. It exists in two places that always stay in sync: the dashboard table you use to review and manage it, and a public embed anyone can drop into a web page.

Viewing and reviewing it in the dashboard

1. Open Dashboard → Cookies for the property you care about (use the site switcher at the top if you manage more than one).

2. The table lists every cookie from the latest scan snapshot, grouped by category with a colored badge (green for Necessary, and so on), and a Scanned on badge showing when the underlying data was last refreshed.

3. Use the search box and the category/provider filter dropdowns to narrow a long list — e.g. filter to Unclassified to find cookies that still need a human decision, or to a specific provider to check everything one vendor sets.

4. If the table looks stale or incomplete, run (or re-run) a scan — see the Cookie scanner guide for the Scan now flow, and for how live observation fills in cookies a crawl alone might miss. The declaration table always reflects whatever the most recent snapshot contains; there's no separate "build the declaration" step.

Publishing it on your site

The same data that powers the dashboard table is available as a small, dependency-free embed script anyone with page-editing access can install — they don't need dashboard access, just your property's site ID:

<script src="https://YOUR-CMP-DOMAIN/cookie-declaration.js" data-cbid="YOUR_SITE_ID"></script>

Steps:

1. Find your property's site ID (cbid) on Dashboard → Properties — it's shown on the site's card, and clicking it copies it. (It's the same ID used in your main install <script> tag, visible via that card's Install dialog.)

2. Replace YOUR-CMP-DOMAIN with the domain your Cookie Munch instance is served from, and YOUR_SITE_ID with the cbid from step 1.

3. Paste that one <script> tag anywhere in the page you want the table to appear — typically your cookie policy or privacy policy page, wherever your policy text says "here is a list of the cookies we use."

4. Load the page. The script finds its own <script> tag, reads data-cbid, fetches the live declaration feed for that site, and renders the grouped table directly into the page next to the script tag — no CSS or JavaScript dependencies required from the host page.

How it stays current

Both surfaces — the dashboard table and the embed — read from the same public feed (GET /api/v1/:cbid/cookies), which always serves whatever the latest scan snapshot contains. That means:

• There's nothing to "republish" on your policy page when your cookies change. The widget re-fetches the feed on every page load, so the next visitor to your policy page sees the current list automatically.

• If a cookie was Unclassified at scan time but a later database update recognizes it, the feed serves the upgraded classification immediately — again, without you touching the embed or re-scanning.

• The embed shows a Last updated timestamp at the bottom of the table so visitors (and you) can see how fresh the data is at a glance.

• If nothing has been scanned yet for a property, both the dashboard table and the embed simply show an empty/"no cookies detected yet" state rather than an error — run a scan to populate it.

Tips

• Keep the embed and the dashboard table pointed at the same property: the cbid in your embed tag must match the property you're actually scanning, or the table will show someone else's (or nobody's) data.

• Treat the declaration as only as good as your last scan: if you add a new analytics or ad script, run a fresh scan (or make sure live observation is on) before assuming the published table reflects it — see the Cookie scanner guide.

• Resolve Unclassified cookies from the dashboard's Cookies view before pointing regulators or auditors at the public embed — an honest "unclassified, pending review" entry is fine, but it's worth minimizing how many show up on a page the public can see.

• The embed is intentionally unstyled beyond basic table borders and system fonts so it drops cleanly into any page's existing design — if you want a fully custom look, the same feed (/api/v1/:cbid/cookies) is plain JSON you can render with your own markup instead of using the script tag.