Analyzing and mitigating website privacy issues by automatically classifying cookies. In some embodiments, a method may include identifying a cookie for a website, obtaining a cookie generation flow related to generation of the cookie, obtaining a cookie sharing flow related to sharing of the cookie, extracting features related to the cookie generation flow and the cookie sharing flow, determining flow patterns in the cookie generation flow and the cookie sharing flow, automatically creating a stratified classification for the cookie based on the features and the flow patterns that explains how the cookie interacts with a website and with third-party resources loaded on the website, determining whether the stratified classification for the cookie exceeds a weighted suspiciousness threshold value, and in response to determining that the stratified classification for the cookie exceeds the weighted suspiciousness threshold value, determining that the cookie is suspicious and initiating a security action on the cookie.