Cookie files are screened in a client machine, wherein a cookie file includes a cookie file source. A request from a subscriber is received at a server to send a list of untrusted cookie file sources to the client machine. The list of untrusted cookie file sources is downloaded from the server to the client machine. The downloaded list of untrusted cookie file sources is used to detect cookie files received at the client machine from cookie file sources on the downloaded list by comparing the cookie file source of any received cookie file to the untrusted cookie file sources on the downloaded list.