GDPR.ME.UK · WORKING DOCUMENT 77

Cookie, tag and marketing audit workbook

Combine a permissions review with observed browser and campaign behaviour. Use a controlled test environment or an authorised inspection of the relevant website. Record findings rather than assuming a banner’s appearance proves compliance.

Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.

Use alongside the cookies and marketing guide and evidence-to-action method.

Record details

Organisation or activity reference

Responsible owner or role

Record reference and version

Review date

1. Define the test scope

List domains, subdomains, pages, embedded content, apps, audiences and marketing channels.
Record browser/device, consent manager, tag manager and relevant configuration versions. Test fresh storage and returning-user states.
Identify authorisation, test accounts and a safe way to avoid sending unintended marketing or recording real sensitive information.

Site / application / campaign scope

Reviewer / authority / test date

Browser / device / region

Consent and tag configuration versions

Fresh / returning / logged-in states

Test account and evidence location

2. Inventory storage, tags and network requests

Observe cookies, local storage, pixels and other storage/access technologies; record provider, purpose, duration, destination and when they activate.
Test before a choice, after reject, after each category choice, after accept and after withdrawal. Recheck navigation and embedded media.
Save proportionate technical evidence and distinguish observed facts from unverified assumptions. Same-site script names do not prove that no third-party data is sent.

Technology / key / provider

Purpose / data / duration / destination

Pre-choice behaviour

Reject / granular choice / accept behaviour

Withdrawal and return-visit behaviour

Network / storage evidence and finding

3. Test consent or a specific exception

For each technology identify valid consent or the precise PECR exception and all its conditions.
Statistical and appearance exceptions require appropriate transparency and a simple free objection route; do not treat behavioural advertising or unrestricted analytics as exempt.
Where consent is required, inspect pre-consent blocking, clear choices, comparable ease of rejection and acceptance, granularity, records and withdrawal. Do not preselect optional consent.

Technology / purpose / legal route

Exception conditions and evidence

Notice and objection mechanism

Banner choice and blocking tests

Consent record fields and retention

Defect / action / owner / retest

4. Audit marketing audience and provenance

Identify individual versus corporate subscribers; sole traders and some partnerships are individual subscribers under PECR.
For each list and channel record consent or the applicable fully satisfied soft opt-in. Capture collection source, wording, purpose and opt-outs.
Distinguish the products-and-services route from the charitable-purposes route. Public availability, purchase of a list or a general business relationship does not itself prove permission.
Review named-person UK GDPR basis, transparency and objection handling as well as PECR.

List / channel / audience type

Source and collection date

Consent or soft-opt-in route and evidence

Original wording / opt-out at collection

UK GDPR basis and notice record

Bought-in / public-source checks and gaps

5. Test messaging, unsubscribe and calls

Check sender identity and an effective opt-out in each message. Test unsubscribe through every sending system and confirm suppression survives re-import.
For live marketing calls, check internal objections and TPS/CTPS rules, including any applicable specific consent requirements.
Recorded automated marketing calls need specific consent for that channel. General marketing or live-call consent is not sufficient.

Message identity and opt-out test

Unsubscribe date / systems updated / result

Suppression list control and re-import test

TPS / CTPS / objection screening evidence

Automated-call consent evidence

Failure / owner / corrective action

6. Reconcile, fix and retest

Reconcile the published notice with actual technologies and purposes. Update configuration and evidence together.
Prioritise unlawful activation, ineffective rejection and marketing without a valid route. Pause affected activity where necessary while decisions are made.
Retest after fixes and after tag, supplier or campaign changes. Record results and accountable approval.

Finding and affected activity

Priority and containment

Configuration / notice / list change

Owner and target date

Retest evidence and result

Approval and next review triggers

Sources and completion

Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.

The template does not verify facts, perform an audit, submit a notification or execute a contract.