Website Privacy & Cookie Compliance Checklist Template

The jurisdictions chosen on the first task decide whether Phases 2 and 4 appear. The answer on the second task decides whether Phase 5 appears.

• Set the scope and jurisdictions for this review — domains, subdomains and key journeys, the trigger for the review, the privacy lead, the web owner and where your visitors are
• Scan the site before any banner choice is made — a clean browser from an EU or UK location where relevant; record every cookie, storage item and third-party request
• Scan again after Reject all and after Accept all — after rejecting, only strictly necessary or exempt items remain; after accepting, the result matches the cookie list
• Reconcile the scan with the tag manager and hard-coded scripts — every tag has an owner, a purpose and a consent category; remove tags nobody claims
• Classify each cookie strictly — ‘strictly necessary’ means the service the visitor asked for fails without it; the EDPB taskforce found many mislabelled

Shown when the review covers EU/EEA or UK visitors. The exception task appears only when the UK is selected.

• Check refusing is as easy as accepting — a Reject option on the same layer as Accept, just as visible, and never a link buried in a paragraph
• Check nothing is pre-ticked and choices are granular — separate purposes such as analytics and advertising, each off until the visitor switches it on
• Check the banner explains purposes, recipients and duration — the visitor learns who receives the data and how long cookies last before choosing
• Check legitimate interest is not offered as a basis for cookies — the EDPB taskforce agreed it cannot justify placing or reading them
• UK: record each cookie that relies on a PECR exception — statistical or appearance purposes only, explained clearly, with a simple and free way to object
• Test withdrawing consent from any page — a footer link or icon reopens the settings, and withdrawing stops the tags, not just the banner
• Check the consent platform passes choices to every tag — tag-manager triggers and Google Consent Mode or IAB TCF signals default to denied

• Compare the privacy notice and cookie policy with the scan — every vendor, purpose and retention period found is described, and removed tools are taken out
• Walk every form on the site — collect only the fields the purpose needs, give notice at the point of collection and leave marketing boxes unticked
• Check pixels and session replay on sensitive pages — login, checkout, account, health and finance pages; mask inputs and keep form contents out of URLs
• Check embedded content and widgets — video players, maps and chat tools often set cookies on page load; load them after consent or on click
• Check the routes to exercise privacy rights — the request form or address works and messages reach the team that handles requests
• Decide whether the site is likely to attract children — if so, apply the consent ages: 13 to 16 across the EU, 13 in the UK, and COPPA for under-13s in the US

Shown when the review covers California or other US states.

• Decide whether any tag sells or shares personal information — in California, ad pixels used for cross-context behavioural advertising usually count as sharing
• Check the Do Not Sell or Share link appears on every page — in the footer, leading to an opt-out that needs no account or identity check
• Test Global Privacy Control in a GPC-enabled browser — selling and sharing tags stop, and the site shows the visitor that the signal was honoured
• Check signal handling for each state law that applies to you — thresholds differ by state, so record which laws you meet and test against each
• Compare the opt-out path with the opt-in path — saying no takes no more steps than saying yes; asymmetry was one ground for the agency’s 2025 Honda decision

Shown only when the first scan found non-essential cookies set before consent.

• Trace each pre-consent cookie to its source — a hard-coded script, a tag-manager trigger, an embedded widget or a miscategorised cookie in the consent platform
• Block each tag until the visitor consents — move it behind a consent trigger, or let the consent platform hold the script until a choice is made
• Retest in a clean browser for each jurisdiction — repeat the three Phase 1 scans and attach the new reports
• Record how long the issue ran and which vendors received data — the privacy lead decides on follow-up, such as asking a vendor to delete it
• Add a consent check to the release process — a scan of the staging site before each release stops the same tag returning next sprint

The approval is assigned to the privacy lead named in Phase 1.

• Update the privacy notice and cookie policy — reflect the scan, the fixes and any new vendors, with a new version date
• Privacy lead approves the updated notice — checks it against the scan and the banner wording, then records Approved or Not approved
• Publish the update and archive the evidence — scan reports, banner screenshots and the old and new notice versions, kept together
• Log remaining findings with an owner and a date — anything not fixed in this review is tracked to closure, not rediscovered next quarter
• Set the next review — next quarter, or sooner if a redesign, a new consent platform or a new marketing tag is planned