COMPLIANCE

Cookie Consent Audit

Audit of cookie banners, preference center, and tracking technologies for compliance with the ePrivacy Directive and the GDPR consent standard.

Tasks
12
Span
14d
Use this template in Dorift Download for Android Download as JSON

Tasks in this template

  1. 1
    Scan the site and build an inventory of cookies and similar technologies D+1
  2. 2
    Classify cookies (strictly necessary, functional, analytics, marketing) D+3

    Only strictly necessary cookies may be set without prior consent (ePrivacy Art. 5(3)). All others require informed, specific, freely given consent.

  3. 3
    Map purposes, legal bases, retention periods, and third-party recipients D+4

    EDPB Guidelines 05/2020: consent must be as easy to withdraw as to give. Pre-ticked boxes are not valid consent.

  4. 4
    Review the cookie banner wording against IAB TCF and national DPA guidance D+5
  5. 5
    Test reject-all is equally prominent and one-click D+6

    CNIL, Garante, and BfDI guidance: reject-all must be available on the first layer and as easy as accept-all. Dark patterns are not compliant.

  6. 6
    Verify no non-essential cookies are set before user consent D+7

    ePrivacy Art. 5(3): storage or access to information on terminal equipment requires prior consent except for strictly necessary cases.

  7. 7
    Review the cookie policy page for completeness and clarity D+8
  8. 8
    Test consent withdrawal and preference change flows D+9
  9. 9
    Scan for tracking pixels, fingerprinting, and server-side tracking D+10
  10. 10
    Audit embedded third-party content (maps, video, social embeds) D+11
  11. 11
    Update the RoPA with cookie-related processing activities D+12

    Article 30: analytics and marketing cookies are processing activities and must be recorded with purpose, legal basis, and retention.

  12. 12
    Schedule the next cookie audit (recommended quarterly) D+14
← Back to Dorift