# Cookie, tag and marketing audit workbook

Combine a permissions review with observed browser and campaign behaviour. Use a controlled test environment or an authorised inspection of the relevant website. Record findings rather than assuming a banner’s appearance proves compliance.

Document edition 2 — 1 November 2026

Organisation / activity: 
Owner: 
Reference and version: 
Review date: 

## 1. Define the test scope

- List domains, subdomains, pages, embedded content, apps, audiences and marketing channels.
- Record browser/device, consent manager, tag manager and relevant configuration versions. Test fresh storage and returning-user states.
- Identify authorisation, test accounts and a safe way to avoid sending unintended marketing or recording real sensitive information.

Site / application / campaign scope: 
Reviewer / authority / test date: 
Browser / device / region: 
Consent and tag configuration versions: 
Fresh / returning / logged-in states: 
Test account and evidence location: 

## 2. Inventory storage, tags and network requests

- Observe cookies, local storage, pixels and other storage/access technologies; record provider, purpose, duration, destination and when they activate.
- Test before a choice, after reject, after each category choice, after accept and after withdrawal. Recheck navigation and embedded media.
- Save proportionate technical evidence and distinguish observed facts from unverified assumptions. Same-site script names do not prove that no third-party data is sent.

Technology / key / provider: 
Purpose / data / duration / destination: 
Pre-choice behaviour: 
Reject / granular choice / accept behaviour: 
Withdrawal and return-visit behaviour: 
Network / storage evidence and finding: 

## 3. Test consent or a specific exception

- For each technology identify valid consent or the precise PECR exception and all its conditions.
- Statistical and appearance exceptions require appropriate transparency and a simple free objection route; do not treat behavioural advertising or unrestricted analytics as exempt.
- Where consent is required, inspect pre-consent blocking, clear choices, comparable ease of rejection and acceptance, granularity, records and withdrawal. Do not preselect optional consent.

Technology / purpose / legal route: 
Exception conditions and evidence: 
Notice and objection mechanism: 
Banner choice and blocking tests: 
Consent record fields and retention: 
Defect / action / owner / retest: 

## 4. Audit marketing audience and provenance

- Identify individual versus corporate subscribers; sole traders and some partnerships are individual subscribers under PECR.
- For each list and channel record consent or the applicable fully satisfied soft opt-in. Capture collection source, wording, purpose and opt-outs.
- Distinguish the products-and-services route from the charitable-purposes route. Public availability, purchase of a list or a general business relationship does not itself prove permission.
- Review named-person UK GDPR basis, transparency and objection handling as well as PECR.

List / channel / audience type: 
Source and collection date: 
Consent or soft-opt-in route and evidence: 
Original wording / opt-out at collection: 
UK GDPR basis and notice record: 
Bought-in / public-source checks and gaps: 

## 5. Test messaging, unsubscribe and calls

- Check sender identity and an effective opt-out in each message. Test unsubscribe through every sending system and confirm suppression survives re-import.
- For live marketing calls, check internal objections and TPS/CTPS rules, including any applicable specific consent requirements.
- Recorded automated marketing calls need specific consent for that channel. General marketing or live-call consent is not sufficient.

Message identity and opt-out test: 
Unsubscribe date / systems updated / result: 
Suppression list control and re-import test: 
TPS / CTPS / objection screening evidence: 
Automated-call consent evidence: 
Failure / owner / corrective action: 

## 6. Reconcile, fix and retest

- Reconcile the published notice with actual technologies and purposes. Update configuration and evidence together.
- Prioritise unlawful activation, ineffective rejection and marketing without a valid route. Pause affected activity where necessary while decisions are made.
- Retest after fixes and after tag, supplier or campaign changes. Record results and accountable approval.

Finding and affected activity: 
Priority and containment: 
Configuration / notice / list change: 
Owner and target date: 
Retest evidence and result: 
Approval and next review triggers: 

## Sources

- ICO: Storage and access technologies: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/
- ICO: Storage and access exceptions: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/
- ICO: Direct marketing by electronic mail: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/
- ICO: Telephone marketing: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/telephone-marketing/