Using AI to review cookie categories without losing control

The scanner runs first

AI can't produce good classifications from bad input, so in UserGuard the scanner runs first. It crawls your site in two passes across up to 50 pages by default and records a cookie only when there's hard evidence for it: a Set-Cookie header, an HTTP-only record, or a value in document.cookie. Any other tracking technology it finds is kept separately as labeled context, so it doesn't pad out your cookie list.

Everything after that depends on this evidence gate. When the AI drafts a classification, it's working from something verified on your own site, so it doesn't have to guess from a directory of cookies other sites happen to use.

What does the AI draft, and how sure is it?

For each verified cookie, AI review drafts a category, a provider, and a purpose in plain language, with a confidence percentage. Cookie names are cryptic, by accident or on purpose, and few site owners can say offhand what _fbp, _ga, or intercom-device-id does. The draft gives you something you can read and check.

Use the confidence number to decide where to look. A 90 percent suggestion about a well-known analytics cookie deserves different scrutiny than a 60 percent guess about something first-party and obscure. The lower the confidence, the more closely you should check the draft.

Does AI review publish anything on its own?

No. Every AI suggestion in UserGuard waits for a person to decide. No draft reaches your banner, your preference center, or your cookie policy until you approve it, and we don't plan to automate that step away.

We keep that step because categories decide what gets blocked before consent, through Consent Mode v2 defaults and script blocking rules, so a wrong label changes how your site behaves. A marketing cookie mislabeled as necessary fires before anyone agrees, and tags firing before the choice is what enforcement actions on both sides of the Atlantic keep turning on.

Approved records feed the documents

Once you approve the inventory, UserGuard generates a cookie policy draft from it, covering what each category does, why the site uses it, and how visitors manage their preferences. Drafts are versioned and, like everything else here, are for a person to review and edit before publishing.

The policy comes from your approved records and not from a template, so it stays connected to what your site sets. When a rescan changes the inventory, the document has your latest records to update from, which most generic cookie policies don't have.

AI review is the one metered feature

AI review is the only metered feature in UserGuard. You get 10 runs per site per month, which comfortably covers a rescan cadence without encouraging you to keep rerunning it in place of your own judgment. Nothing with direct compliance weight, including Global Privacy Control handling, sits behind a meter or an upgrade.

If you want to test the workflow on your own site, it doesn't take long. Run a scan, read the drafts next to their confidence scores, and see whether you could explain every cookie to a visitor in one sentence. Any cookie you can't explain goes on this month's review list.

Go deeper: how AI review fits the workflow