Cookie audit checklist

Prepare a useful record

Choose representative pages: the homepage, a landing page, a page with video or maps, and a booking or contact page if present. Stay on public pages and avoid submitting real personal information.

• Record the date, page address, device and browser.
• Identify the consent platform and your website maintainer.
• Write down which pages were reached and which were blocked or skipped.

Check the choices

Inspect the controls as a visitor would. Record the labels and number of steps instead of simply writing “banner present”.

• Can you find an understandable refusal choice?
• Can you compare Accept and Reject without guessing?
• Are optional categories preselected?
• Can you find settings again after the banner closes?

Check the behaviour

Use separate clean starting sessions. Record storage observations before a choice, after Reject, after reload and after Accept. A request to a third-party server alone does not establish that a cookie was stored or that a rule was breached.

• Note the technology, operation and visitor state.
• Distinguish a saved consent preference from advertising activity.
• Record unclassified technology as a question for investigation.
• Do not call an unsupported or incomplete test a pass.

Check purposes and owners

Compare the tools you found with the cookie information. Ask the maintainer to confirm purpose and settings for unknown entries. Record the applicable consent requirement or exception and why it applies; do not assume all analytics has the same treatment.

ICO: storage technologies and their purposes ↗

Verify each change

Assign a person, describe the change and repeat the original test. Save both results. If the check remains inconclusive, record the remaining question and the manual review needed. A resolved technical issue is not a certificate covering the whole business.