# Cookie Compliance Checklist ## GDPR, CCPA & ePrivacy Ready *A scored, 50-point audit of your website's cookie compliance — with the exact violations regulators fine for, real enforcement examples, and a 60-second DevTools check. Fix the gaps before they find them.* --- ## Your Compliance Score | Section | Items | Completed | Score | |---------|-------|-----------|-------| | Before Cookies Load | 8 | ___/8 | ___% | | Consent Banner | 10 | ___/10 | ___% | | Cookie Policy Page | 8 | ___/8 | ___% | | Technical Implementation | 10 | ___/10 | ___% | | CCPA Requirements | 6 | ___/6 | ___% | | Documentation | 8 | ___/8 | ___% | | **TOTAL** | **50** | **___/50** | **___% ** | --- ## Section 1: Before Cookies Load *The most common compliance failure - cookies firing before consent* - [ ] **1.1** Cookie banner displays before any non-essential cookies load - *Critical: Many sites fail here. Test with browser dev tools.* - [ ] **1.2** No cookies set on page load (except strictly necessary) - *Strictly necessary = essential for site function (session, security)* - [ ] **1.3** Analytics tracking blocked until consent given - *Google Analytics, Plausible, etc. must wait for opt-in* - [ ] **1.4** Marketing/advertising pixels blocked until consent given - *Meta Pixel, Google Ads, TikTok, etc.* - [ ] **1.5** Geolocation detection for consent requirements - *Different rules for EU vs US vs other regions* - [ ] **1.6** No pre-checked consent boxes - *GDPR explicitly prohibits pre-ticked boxes* - [ ] **1.7** Clear "Reject All" option equally visible as "Accept All" - *Can't hide reject option or make it harder to find* - [ ] **1.8** No cookie walls (blocking content until consent) - *Consent must be freely given - can't force it* --- ## Section 2: Consent Banner Requirements *What your cookie banner must include* - [ ] **2.1** Clear explanation of what cookies are used for - *Plain language, not legal jargon* - [ ] **2.2** Easy-to-understand language (no legal jargon) - *Test: Would a 12-year-old understand it?* - [ ] **2.3** "Accept All" and "Reject All" equally prominent - *Same size buttons, same visual weight* - [ ] **2.4** Link to full cookie policy visible - *Don't hide it in tiny text* - [ ] **2.5** Granular consent options available - *Users should be able to accept some categories, reject others* - [ ] **2.6** Ability to change preferences later - *Persistent link to manage cookies (usually in footer)* - [ ] **2.7** Mobile-responsive design - *Banner works well on phones and tablets* - [ ] **2.8** Accessible (screen reader compatible) - *WCAG 2.1 compliance, keyboard navigable* - [ ] **2.9** Loads fast (doesn't delay page) - *Banner should appear within 1 second* - [ ] **2.10** Available in user's language - *Match the language of your website content* --- ## Section 3: Cookie Policy Page *Your detailed cookie disclosure* - [ ] **3.1** Complete list of all cookies used - *Every single cookie, not just the main ones* - [ ] **3.2** Cookie categories clearly explained - *Strictly Necessary, Analytics, Functional, Marketing* - [ ] **3.3** Third-party cookies identified - *Who sets them and why* - [ ] **3.4** Duration/expiry of each cookie stated - *Session vs persistent, exact expiry times* - [ ] **3.5** How to delete cookies (browser instructions) - *Link to instructions for major browsers* - [ ] **3.6** Contact information for questions - *Email or form for cookie-related inquiries* - [ ] **3.7** Last updated date visible - *Shows policy is maintained* - [ ] **3.8** Policy linked from consent banner - *Easy to find from the banner* --- ## Section 4: Technical Implementation *The behind-the-scenes compliance* - [ ] **4.1** Cookie script blocks non-essential cookies by default - *Cookies only fire after opt-in* - [ ] **4.2** Consent choice stored and respected across sessions - *Don't ask again on every page load* - [ ] **4.3** Consent proof stored for records - *Timestamp, version, what was consented to* - [ ] **4.4** Cookies cleared/blocked on consent withdrawal - *When user opts out, cookies must be removed* - [ ] **4.5** Third-party scripts respect consent status - *All marketing tags honor the consent decision* - [ ] **4.6** Tag manager configured for consent mode - *GTM or similar respects consent signals* - [ ] **4.7** Google Consent Mode v2 implemented (if using Google) - *Required for Google Ads/Analytics as of March 2024* - [ ] **4.8** Analytics respects consent - *No tracking before opt-in, even anonymized* - [ ] **4.9** Ad pixels respect consent - *Facebook, TikTok, LinkedIn pixels blocked until consent* - [ ] **4.10** Regular cookie audit scheduled (quarterly) - *New cookies can appear without you knowing* --- ## Section 5: CCPA-Specific Requirements *For California visitors* - [ ] **5.1** "Do Not Sell or Share My Personal Information" link visible - *Required in footer for California users* - [ ] **5.2** Opt-out mechanism for data sales/sharing works - *Must actually stop data sharing when clicked* - [ ] **5.3** Privacy policy includes CCPA disclosures - *Categories of data collected, purposes, rights* - [ ] **5.4** Process for consumer data requests in place - *Right to know, delete, and opt-out* - [ ] **5.5** Verification process for requests documented - *How you verify identity before fulfilling requests* - [ ] **5.6** Response within 45 days confirmed - *CCPA timeline requirement* --- ## Section 6: Documentation & Governance *Proving your compliance* - [ ] **6.1** Cookie register/inventory maintained - *List of all cookies with full details* - [ ] **6.2** Vendor list with DPAs signed - *Contracts with all cookie-setting third parties* - [ ] **6.3** Consent records exportable - *Can produce records if audited* - [ ] **6.4** Audit trail for consent changes - *History of user consent decisions* - [ ] **6.5** Regular testing documented - *Periodic checks that everything works* - [ ] **6.6** Staff training on cookie handling - *Marketing team knows the rules* - [ ] **6.7** Incident response plan for cookie issues - *What to do if cookies fire without consent* - [ ] **6.8** Annual review scheduled - *Policy and implementation review* --- ## Common Cookie Compliance Mistakes ### Mistake #1: Hidden "Reject" Button Making "Reject All" smaller, different color, or requiring extra clicks. **Fine risk:** Up to €20M or 4% of global revenue ### Mistake #2: Pre-ticked Boxes Having consent categories pre-selected. **Fine risk:** Invalid consent, all data collected is unlawful ### Mistake #3: Cookie Walls Blocking content until users accept cookies. **Fine risk:** Consent not freely given, deemed invalid ### Mistake #4: Incomplete Cookie List Not disclosing all cookies in your policy. **Fine risk:** Transparency violation ### Mistake #5: No Way to Withdraw Consent Not providing easy access to change cookie preferences. **Fine risk:** Article 7(3) GDPR violation --- ## Real Enforcement Examples | Company | Fine | Violation | |---------|------|-----------| | Google | €150M | Cookie consent issues (France) | | Amazon | €35M | Cookie consent issues (France) | | Microsoft | €60M | Cookie consent issues (France) | | Criteo | €40M | Invalid consent for tracking | --- ## Quick Cookie Audit Run this 60-second check on your website: 1. **Open your site in incognito/private mode** 2. **Open browser dev tools (F12) → Application → Cookies** 3. **Before clicking anything on cookie banner:** - Are there cookies already set? (Should only be essential) - Is Google Analytics running? (Check Network tab) - Are marketing pixels firing? (Check Network tab) 4. **Click "Reject All":** - Do non-essential cookies get removed? - Does analytics stop? 5. **Refresh the page:** - Does it remember your choice? - Or does the banner appear again? --- ## Cookie Categories Reference ### Strictly Necessary (Always allowed) - Session cookies - Authentication cookies - Security cookies (CSRF) - Load balancer cookies - Cookie consent cookie itself ### Functional (Requires consent) - Language preferences - Region settings - User preferences - Chat widgets ### Analytics (Requires consent) - Google Analytics - Plausible - Hotjar - Mixpanel - Any usage tracking ### Marketing/Advertising (Requires consent) - Meta Pixel - Google Ads - TikTok Pixel - LinkedIn Insight - Retargeting cookies - Cross-site tracking --- ## Ready to Automate Cookie Compliance? **GetCookies** handles everything automatically: - **Automatic cookie scanning** - Discover all cookies on your site - **Smart consent banner** - Equal-weight Reject All by default, customizable, fast - **Geo-targeting** - GDPR for the EEA/UK, opt-out model for US states - **Google Consent Mode v2** - Built-in support - **Audit-ready records** - Exportable, timestamped consent logs to prove compliance **Scan your site free →** getcookies.co --- *This checklist is for informational purposes and does not constitute legal advice.* **Version 1.1 | 2026**