Open navigation menu
Website consent audit checklist
Turn a consent review into a practical worklist: inspect the page, identify the owner of each issue, agree on the expected behavior and retest after changes. Use retained evidence so DPOs, agencies and developers can work from the same facts.
By CertScore.ai · Updated
Start your consent review with a website scan
Enter a public page URL to gather observations for this checklist. Review visible controls, runtime activity, and available action evidence separately, then record unresolved questions in the worksheet.
Loading scan form…
Start with one public page. Open the evidence, identify what to investigate and retest after changes. The report records the scan’s conditions and coverage.
See how to read a report1. Define the review
Record the URL, date, region, reviewer and implementation owner. List the pages and templates covered, plus any journeys left untested. Agree on the expected behavior for essential services, analytics, advertising and embeds.
2. Inspect the untouched page
Use a fresh session without stored consent. Review visible controls, pre-consent cookies, service requests and privacy disclosures. Keep evidence references for each observation and note missing coverage.
3. Compare eligible Accept and Reject paths
Use separate fresh sessions. Check the completed click, available choice-state evidence and observation window independently. After Reject, inspect retained non-essential cookies and services; distinguish presence from active collection. Test GPC separately for California review.
4. Reconcile disclosures and behavior
Match the target site’s retained policy passages with the relevant vendors, purposes and consent state. Ask the privacy owner to review unexplained differences. Missing policy evidence is not proof of a contradiction.
5. Record the fix and retest
For each issue record the observation, evidence link, expected behavior, owner, proposed change and retest date. Inspect consent mappings, tag triggers, plugins and vendor settings. Keep sensitive values out of tickets.
6. Close only what the evidence supports
Compare a fresh scan under matching conditions after the change. Keep blocked or incomplete checks open. Repeat the review when CMP settings, vendors or site templates change.
Related CertScore.ai pages
Put the checklist to work on your website
Start with one page, review its evidence, then use “Scan another website” in the report to review another client, brand, or public site.
Enter a website URL