Cookie Compliance Checklist

GDPR, CCPA & ePrivacy Ready

A scored, 50-point audit of your website's cookie compliance — with the exact violations regulators fine for, real enforcement examples, and a 60-second DevTools check. Fix the gaps before they find them.

Your Compliance Score

Section 1: Before Cookies Load

The most common compliance failure - cookies firing before consent

• 1.1 Cookie banner displays before any non-essential cookies load

  • Critical: Many sites fail here. Test with browser dev tools.

• 1.2 No cookies set on page load (except strictly necessary)

  • Strictly necessary = essential for site function (session, security)

• 1.3 Analytics tracking blocked until consent given

  • Google Analytics, Plausible, etc. must wait for opt-in

• 1.4 Marketing/advertising pixels blocked until consent given

  • Meta Pixel, Google Ads, TikTok, etc.

• 1.5 Geolocation detection for consent requirements

  • Different rules for EU vs US vs other regions

• 1.6 No pre-checked consent boxes

  • GDPR explicitly prohibits pre-ticked boxes

• 1.7 Clear "Reject All" option equally visible as "Accept All"

  • Can't hide reject option or make it harder to find

• 1.8 No cookie walls (blocking content until consent)

  • Consent must be freely given - can't force it

Section 2: Consent Banner Requirements

What your cookie banner must include

• 2.1 Clear explanation of what cookies are used for

  • Plain language, not legal jargon

• 2.2 Easy-to-understand language (no legal jargon)

  • Test: Would a 12-year-old understand it?

• 2.3 "Accept All" and "Reject All" equally prominent

  • Same size buttons, same visual weight

• 2.4 Link to full cookie policy visible

  • Don't hide it in tiny text

• 2.5 Granular consent options available

  • Users should be able to accept some categories, reject others

• 2.6 Ability to change preferences later

  • Persistent link to manage cookies (usually in footer)

• 2.7 Mobile-responsive design

  • Banner works well on phones and tablets

• 2.8 Accessible (screen reader compatible)

  • WCAG 2.1 compliance, keyboard navigable

• 2.9 Loads fast (doesn't delay page)

  • Banner should appear within 1 second

• 2.10 Available in user's language

  • Match the language of your website content

Section 3: Cookie Policy Page

Your detailed cookie disclosure

• 3.1 Complete list of all cookies used

  • Every single cookie, not just the main ones

• 3.2 Cookie categories clearly explained

  • Strictly Necessary, Analytics, Functional, Marketing

• 3.3 Third-party cookies identified

  • Who sets them and why

• 3.4 Duration/expiry of each cookie stated

  • Session vs persistent, exact expiry times

• 3.5 How to delete cookies (browser instructions)

  • Link to instructions for major browsers

• 3.6 Contact information for questions

  • Email or form for cookie-related inquiries

• 3.7 Last updated date visible

  • Shows policy is maintained

• 3.8 Policy linked from consent banner

  • Easy to find from the banner

Section 4: Technical Implementation

The behind-the-scenes compliance

• 4.1 Cookie script blocks non-essential cookies by default

  • Cookies only fire after opt-in

• 4.2 Consent choice stored and respected across sessions

  • Don't ask again on every page load

• 4.3 Consent proof stored for records

  • Timestamp, version, what was consented to

• 4.4 Cookies cleared/blocked on consent withdrawal

  • When user opts out, cookies must be removed

• 4.5 Third-party scripts respect consent status

  • All marketing tags honor the consent decision

• 4.6 Tag manager configured for consent mode

  • GTM or similar respects consent signals

• 4.7 Google Consent Mode v2 implemented (if using Google)

  • Required for Google Ads/Analytics as of March 2024

• 4.8 Analytics respects consent

  • No tracking before opt-in, even anonymized

• 4.9 Ad pixels respect consent

  • Facebook, TikTok, LinkedIn pixels blocked until consent

• 4.10 Regular cookie audit scheduled (quarterly)

  • New cookies can appear without you knowing

Section 5: CCPA-Specific Requirements

For California visitors

• 5.1 "Do Not Sell or Share My Personal Information" link visible

  • Required in footer for California users

• 5.2 Opt-out mechanism for data sales/sharing works

  • Must actually stop data sharing when clicked

• 5.3 Privacy policy includes CCPA disclosures

  • Categories of data collected, purposes, rights

• 5.4 Process for consumer data requests in place

  • Right to know, delete, and opt-out

• 5.5 Verification process for requests documented

  • How you verify identity before fulfilling requests

• 5.6 Response within 45 days confirmed

  • CCPA timeline requirement

Section 6: Documentation & Governance

Proving your compliance

• 6.1 Cookie register/inventory maintained

  • List of all cookies with full details

• 6.2 Vendor list with DPAs signed

  • Contracts with all cookie-setting third parties

• 6.3 Consent records exportable

  • Can produce records if audited

• 6.4 Audit trail for consent changes

  • History of user consent decisions

• 6.5 Regular testing documented

  • Periodic checks that everything works

• 6.6 Staff training on cookie handling

  • Marketing team knows the rules

• 6.7 Incident response plan for cookie issues

  • What to do if cookies fire without consent

• 6.8 Annual review scheduled

  • Policy and implementation review

Common Cookie Compliance Mistakes

Mistake #1: Hidden "Reject" Button

Making "Reject All" smaller, different color, or requiring extra clicks. Fine risk: Up to €20M or 4% of global revenue

Mistake #2: Pre-ticked Boxes

Having consent categories pre-selected. Fine risk: Invalid consent, all data collected is unlawful

Mistake #3: Cookie Walls

Blocking content until users accept cookies. Fine risk: Consent not freely given, deemed invalid

Mistake #4: Incomplete Cookie List

Not disclosing all cookies in your policy. Fine risk: Transparency violation

Mistake #5: No Way to Withdraw Consent

Not providing easy access to change cookie preferences. Fine risk: Article 7(3) GDPR violation

Real Enforcement Examples

Quick Cookie Audit

Run this 60-second check on your website:

1. Open your site in incognito/private mode
2. Open browser dev tools (F12) → Application → Cookies
3. Before clicking anything on cookie banner:
   • Are there cookies already set? (Should only be essential)
   • Is Google Analytics running? (Check Network tab)
   • Are marketing pixels firing? (Check Network tab)
4. Click "Reject All":
   • Do non-essential cookies get removed?
   • Does analytics stop?
5. Refresh the page:
   • Does it remember your choice?
   • Or does the banner appear again?

Cookie Categories Reference

Strictly Necessary (Always allowed)

• Session cookies
• Authentication cookies
• Security cookies (CSRF)
• Load balancer cookies
• Cookie consent cookie itself

Functional (Requires consent)

• Language preferences
• Region settings
• User preferences
• Chat widgets

Analytics (Requires consent)

• Google Analytics
• Plausible
• Hotjar
• Mixpanel
• Any usage tracking

Marketing/Advertising (Requires consent)

• Meta Pixel
• Google Ads
• TikTok Pixel
• LinkedIn Insight
• Retargeting cookies
• Cross-site tracking

Ready to Automate Cookie Compliance?

GetCookies handles everything automatically:

• Automatic cookie scanning - Discover all cookies on your site
• Smart consent banner - Equal-weight Reject All by default, customizable, fast
• Geo-targeting - GDPR for the EEA/UK, opt-out model for US states
• Google Consent Mode v2 - Built-in support
• Audit-ready records - Exportable, timestamped consent logs to prove compliance

Scan your site free → getcookies.co

This checklist is for informational purposes and does not constitute legal advice.

Version 1.1 | 2026