---
title: "List every cookie and device read with its · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/records-and-data-map/device-storage-register
id: CMP-82
level: Recommended
region: EU
updated: 2026-10-27
build: a2a6bdfed830
tokens: 924
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# List every cookie and device read with its purpose

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-82
- Level: Recommended
- Chapter: [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md)
- Rule: List every cookie, storage key and device read your sites and apps use in the repository, with its purpose and whether it needs consent. Fail the build when a page sets one that is missing.
- Check: A browser test loads every page template with no consent given and lists the cookies and storage keys set. Every one is on the list and marked as strictly needed. With consent given, every new key is on the list too.
- Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: ePrivacy Directive Article 5(3) needs consent before storing or reading anything on a person's device. The exception is what is strictly needed for the service they asked for. It covers cookies, local storage, pixels and device fingerprints alike. Each country writes it into its own law. In Sweden it is chapter 9 section 28 of the electronic communications act, lag (2022:482), which the Post and Telecom Authority, PTS, supervises. The consent itself works as [Store nothing extra without a yes](https://agentwranglers.se/playbook/website/privacy/cookie-consent.md) says. This list proves which entries need it.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
// Playwright: every cookie set before consent must be on the list as strictly needed
const allowed = new Set(deviceStorage.filter(entry => entry.consent === 'not-needed').map(entry => entry.name));
const cookies = await page.context().cookies();
expect(cookies.map(cookie => cookie.name).filter(name => !allowed.has(name))).toEqual([]);
```

### Python example

```python
# Playwright for Python: the same check
allowed = {entry["name"] for entry in device_storage if entry["consent"] == "not-needed"}
unlisted = [c["name"] for c in page.context.cookies() if c["name"] not in allowed]
assert unlisted == []
```

## Sources

- [ePrivacy Directive 2002/58/EC, Article 5(3)](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [Lag (2022:482) om elektronisk kommunikation, chapter 9 section 28](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2022482-om-elektronisk-kommunikation_sfs-2022-482/)

## Related rules

- WEB-207 [Store nothing extra without a yes](https://agentwranglers.se/playbook/website/privacy/cookie-consent.md) in Website

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/records-and-data-map/device-storage-register">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep every GDPR request in one register with its deadline](https://agentwranglers.se/playbook/compliance/records-and-data-map/gdpr-request-register.md)
- [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md)