Cookie declaration out of date

Why this matters

A stale cookie declaration weakens transparency and can mislead users about what is really being stored or which vendors are active on the site.

How to verify manually

1. Compare the published cookie declaration against a fresh runtime scan.
2. Identify cookies, vendors, or purposes present in evidence but missing from the declaration.
3. Check whether retention periods and categories are still accurate.

Typical root causes

• New tags were added without updating the declaration.
• Old vendors were removed from the stack but still appear in legal copy.
• CMP scans or exports are not part of the release process.

GTM fix

1. Map every GTM tag that sets storage or loads a vendor to your declaration inventory.
2. Retire tags that are no longer documented or justified.
3. Review declaration updates before publishing GTM changes.

WordPress fix

1. Re-scan cookies in your CMP plugin and publish the updated declaration.
2. Check whether plugin-level integrations add new cookies outside the previous inventory.
3. Verify the declaration page is not cached in an outdated state.

Generic fix

1. Treat the cookie declaration as a maintained inventory, not a one-time legal page.
2. Update provider, purpose, category, and duration fields whenever tags change.
3. Tie declaration review into your release checklist.

How to confirm the fix worked

• Confirm every observed cookie is reflected in the declaration.
• Confirm removed vendors are no longer listed if they no longer run.
• Run a fresh scan and compare declaration accuracy after the update.