This paper presents a novel approach for classifying web cookies based on five levels of user privacy risks, ranging from very low (rare/unlikely occurrence or no impact) to very high (frequent/certain occurrence or significant impact). The approach consists of two main phases: risk identification and risk assessment. To identify risks, a GRU-based model is first defined to categorize both encrypted and non-encrypted cookies into five purposes of use (necessary, functionality, analytics, advertising, or undisclosed). Next, user consent is detected from the HTML content of cookie banners, which are extracted from website screenshots using retrained YOLOv8-L visual detection combined with DOM-based feature detection. Potential user privacy risks are then determined by cross-referencing the cookies’ usage purposes with user consent, and real-time web cookie contents. To assess the user privacy risk level, risks are mapped into a matrix with two dimensions: the legal dimension, which represents the purpose of use of cookies, and the technical dimension, which represents the risks’ frequency and impact according to the OWASP Top 10 Privacy Risks V2.0. This approach is experimented using a dataset of 625 cookies from 107 websites (of which 21 are Vietnamese websites), enabling the correct classification of web cookies into five user privacy risk levels.