How AI scan review works

What the AI drafts, and when

A scan first matches every cookie it finds against the known list, and recognized cookies need nothing more. For each cookie the known list didn't recognize, AI drafts three fields: a category, a provider, and a plain-language purpose. This runs automatically after every successful scan, scheduled or manual, and each run spends one of the month's ten. You can also trigger it yourself from the AI review section on the Cookies tab, which sits above the inventory it feeds. The button reads Draft with AI or, with a count of the rows a review would touch, Draft 12 with AI.

AI comes in at this step, and only this step, because a lookup table can't solve an unrecognized cookie. Someone has to propose what an undocumented cookie is for. AI is good at drafting that proposal, but it isn't allowed to make the decision.

Risk flags

Alongside the drafts, the AI raises flags about firing behavior the scan found evidence of. Here are two examples:

• A marketing pixel set cookies during a crawl that granted no consent.
• Ad identifiers were written to localStorage, which cookie-only gating would miss entirely.

A flag describes what the scan observed and gives you something to act on, but it isn't a compliance verdict. Whether an observed behavior is a violation depends on your jurisdiction, your configuration, and facts the scan can't see. Use a flag to see where to look, and decide for yourself what it means.

Confidence levels

Each purpose draft carries a confidence word: high, medium, or low. Those map to 90%, 60%, and 30%. The model chooses one of the words, and it never chooses a number.

We use words because a model that reports 87.3% confidence is still guessing, and the decimal makes the guess look like a measurement with some authority behind it. Three coarse levels tell you what you need for triage: high means verify and approve, medium means read it closely, and low means expect to rewrite it.

Does the AI publish anything?

No. Every field the AI writes (category, provider, purpose) lands in the review queue as a draft. Nothing is approved and nothing is published without a person.

A published cookie inventory is a statement your organization makes to visitors and regulators, so someone has to be accountable for it. A model can speed up the drafting, but it can't be the party responsible for the claim. The AI proposes, the draft waits in the queue, and a person approves it, always in that order.

How many AI reviews does a site get?

Each site gets 10 AI reviews per calendar month. A scheduled scan uses one automatically. The AI review section on the Cookies tab shows the meter, so you can see how many remain before you spend one.

AI review is the only metered feature in the product. Scans and pageviews are never metered, and they'll never count against anything. The evidence pipeline is the compliance-critical path, so we never ration it. The AI is a drafting convenience on top of that, which is why it's the one thing we meter.

When a site runs out of budget:

• Scans keep running, and they stay complete and correct, with no drop in scan quality.
• Unrecognized cookies still land in the review queue, but without AI drafts.
• Drafting resumes on the 1st of the next month.

If you're rationing, spend reviews where the unknowns are, like a site you just onboarded or a site whose tag setup changed. A stable site whose scan matches last month's rarely needs one.