What this review helps you do
A cookies and marketing review checks both the permission decision and what the technology actually does. Inventory each purpose, provider and audience, verify any consent or exception route, and test rejection, objection, withdrawal and suppression against the resulting storage and network activity.
AT A GLANCE
Connect the banner, tags and marketing lists to the rules that actually apply. Test both what the interface says and what the technology does.
The legal position
Storage or access on a user’s device needs valid consent unless a specific PECR exception applies. This covers more than cookies, including relevant pixels, scripts and local storage.
DUAA introduced conditional statistical, appearance and emergency-assistance exceptions. Statistical and appearance uses require clear information and a simple free objection mechanism. They do not authorise behavioural advertising or unrestricted analytics.
For marketing email or text to individual subscribers, use consent or a fully satisfied soft opt-in. The products-and-services soft opt-in requires contact details collected during a sale or negotiation, marketing of your own similar offerings, and an opt-out at collection and every message.
Corporate subscribers have different electronic-mail consent rules, but identity, opt-out and named-person UK GDPR duties remain. Sole traders and some partnerships count as individual subscribers.
Screen live marketing calls against TPS/CTPS and internal objections, subject to the specific legal rules. Recorded automated marketing calls require specific consent. The post-DUAA PECR maximum can reach £17.5 million or 4% of worldwide annual turnover, whichever is higher.
What to review
- Inventory device storage and network activity before consent, after rejection and after each preference choice.
- Test equal clarity of accept and reject, granular choices, withdrawal, blocking and consent evidence.
- Reconcile the cookie notice with actual providers, purposes, duration and exception or consent route.
- Review list provenance, consent wording, subscriber type, soft opt-in evidence and unsubscribe handling.
- Maintain suppression records and test that unsubscribed contacts cannot be accidentally re-imported.
Working outputs
- Cookie and tag evidence log
- Banner configuration and blocking action plan
- Marketing permissions and provenance register
- Suppression and unsubscribe test checklist
PUT THIS GUIDE TO WORK
Review it. Record it. Keep the evidence.
Open the relevant assessment area or complete the matching working document.
Evidence checklist
Use these checks to gather references and identify the evidence that still needs testing.
- Do non-exempt tags wait for consent?
- Can users reject or change choices easily?
- Have we documented conditions for each claimed exception?
- Can we prove the permission route for each audience and channel?
- Do suppression and unsubscribe tests work across every list?
Implementation tip
Test a fresh browser session and inspect the resulting storage and network activity. A well-designed banner does not prove that tags are blocked correctly.
Apply the limits carefully
The assessment is a manual compliance checklist, not a technical scan of an arbitrary website. A live cookie audit needs authorised browser inspection or a separately implemented scanner.
Common misunderstandings
The amended cookie exceptions and PECR enforcement regime took effect on 5 February 2026, subject to the relevant transitional provisions.
The statistical exception does not cover every analytics configuration. The appearance exception does not cover behavioural personalisation simply because it changes what a person sees.
The charitable-purposes soft opt-in has its own eligibility rules and conditions. It does not provide a general exemption for every nonprofit marketing message.
Buying a contact list or finding an address in a public source does not itself establish valid consent for marketing.
Worked example: testing a rejected analytics choice
Illustrative scenario. This is a fictional teaching example, not a client case, professional finding or verified outcome.
A fictional website offers an analytics choice, but its tag configuration has changed since the banner was installed. This example is a testing method, not a finding about GDPR.me.uk or a named provider.
- Control
Storage and access should follow the applicable consent or documented exception route, including any required objection mechanism.
- Evidence
Use a fresh session to inspect the page before a choice, after rejection and after acceptance. Record the observed requests, storage entries, purposes and configuration.
- Finding
A provider still receives a tracking identifier after rejection, while the notice describes only aggregated measurement. The actual behaviour does not match the documented decision.
- Owner and action
The website owner disables or corrects the disputed configuration while the purpose and permission route are assessed, then aligns the notice and controls with the result.
- Verification
Repeat each choice path in a fresh session and retain the observations. Test withdrawal or objection and check that future releases preserve the intended behaviour.
Practical questions
Can a cookie banner prove that a website is compliant?
The banner is only one part of the evidence. Check what loads and what information is stored or sent for each choice, and compare those results with the assessed purposes, notice and applicable permission route.
Why keep a suppression record after someone unsubscribes?
A limited suppression record can help honour the objection and prevent accidental re-import. Document its purpose, access and retention, and test that every relevant sending list respects it.
Official sources
- ICO: Storage and access technologies guidance (opens in a new tab)
- ICO: Storage and access exceptions (opens in a new tab)
- ICO: Direct marketing by electronic mail (opens in a new tab)
- ICO: Plan direct marketing (opens in a new tab)
- ICO: Telephone marketing (opens in a new tab)
- ICO: DUAA commencement statement (opens in a new tab)
Source-linked editorial review: 1 November 2026. Guidance supports a documented process. It does not replace advice about your particular circumstances or verify your organisation’s compliance.
Content update — 2 November 2026: added an illustrative evidence record, practical questions and related guidance. The existing legal-source baseline is 1 November 2026.