Privacy Signals Audit
Visible privacy signals - cookie consent flow, policy completeness, third-party trackers, and data subject pathways.
A privacy audit checks visible signals related to privacy readiness, including cookie consent flows, privacy policy completeness, third-party tracker disclosure, and data subject pathways. Findings are mapped to relevant regulatory themes, but the audit is not legal advice.
Scope note. This audit checks visible privacy and consent signals on a public website. It is not legal advice or a formal compliance certification.
Audit suite
Privacy
Verified checks
Example findings
8
Every check verified against live data.
Grouped into 5 categories. Code runs every check against your live site - AI only writes the narrative around verified findings. Methodology is proprietary; the cards below describe what each category catches.
01
11 checksCookie Consent
Consent-flow signals: banner presence, granular categories, equal-prominence reject, GPC acknowledgement, and chatbot disclosure checks where visible.
02
7 checksTracker Inventory
Every third-party service that receives user data - analytics, ad pixels, chat widgets, CDN-loaded scripts - surfaced and tagged by jurisdiction risk.
03
10 checksPrivacy Policy
Policy completeness signals across common privacy themes: lawful basis language, retention periods, data rights pathways, and contact details.
04
4 checksForms & Data Collection
Every form on the site graded for privacy hygiene - purpose disclosure, opt-in mechanics, salary-history bans, children's data handling.
05
2 checksThird-Party Sharing
Whether you disclose sending data overseas and let visitors opt out of having their data used to train AI models - most small businesses only need these two. Also checks a required EU data-access channel for businesses selling connected/IoT devices, and Apple ATT disclosure for linked apps (cross-border transfer disclosure, AI training opt-out, EU Data Act DSR endpoint for B2B IoT).
Specific check definitions, regex patterns, and severity rubrics are not published. The output is a verified, evidence-backed report - not a methodology document.
Three things that quietly cost you customers.
Cookie consent gaps create review risk.
Many privacy regimes expect clear consent handling for non-essential cookies. The audit identifies visible cases where analytics or advertising cookies appear to load before consent is recorded.
Pre-selected consent choices create privacy-review friction.
Many privacy reviewers expect consent choices to be explicit and balanced. The audit flags banners where "accept all" appears pre-selected or easier than rejecting non-essential tracking.
Vague retention language creates avoidable review work.
Many privacy frameworks expect organisations to explain how long personal data is kept. If your policy does not state retention periods, customers and reviewers have less evidence that deletion practices are defined.
Six ways cookie banners silently break
Most cookie banners look compliant. Few actually are.
AuditHQ runs every page in a real headless browser and checks what cookies actually fire, in what order, and against the consent state. Below are the six failure modes most banners exhibit - each one verifiable with a real browser, not a static inspection.
Trackers fire before consent
What goes wrong
The banner asks for consent, but the page already loaded Google Analytics, the Meta Pixel, or a CDN-loaded chat widget before the user clicked anything. The banner is decorative - cookies are set unconditionally.
What AuditHQ checks
We open the page in a real headless browser and capture every cookie set on first paint, before any user interaction. Trackers firing pre-consent are flagged with the exact script and the cookies it set.
Reject is harder than accept
What goes wrong
"Accept all" is a single bright button. "Reject" is hidden behind "Manage preferences", then a toggle list, then a save button. The friction asymmetry is the dark pattern - and it is one of the most-cited consent-flow issues in privacy reviews.
What AuditHQ checks
We measure click-distance to reject vs accept, and visual prominence (size, contrast, position). If reject takes more than one click or is visibly less prominent, it is flagged.
Visual asymmetry between accept and reject
What goes wrong
"Accept" is a bright, high-contrast primary button. "Reject" is grey, smaller, or visually demoted - sometimes phrased as a loss ("reject and lose personalised experiences"). Same two choices, but the visual hierarchy nudges every user toward accepting.
What AuditHQ checks
The dark-pattern check measures button size, colour contrast, and visual prominence between accept and reject. Banners where the two controls are not visually equal are flagged - along with any loss-framed reject copy detected nearby.
No granular categories at all
What goes wrong
The banner offers "Accept" and "Reject" with no way to opt into analytics but reject marketing trackers separately. Users can either accept all tracking or block everything that isn't strictly necessary.
What AuditHQ checks
We check whether the banner exposes separate controls for essential, analytics, marketing, and personalisation categories. Banners with a binary accept/reject are flagged with the missing categories.
No way to withdraw consent later
What goes wrong
User accepts on first visit. On visit 2, there is no visible link, banner re-prompt, or settings page that lets them change their mind. Consent has effectively become permanent and that is its own consent-flow gap.
What AuditHQ checks
We look for a discoverable consent-withdrawal mechanism - a persistent settings link in the footer or a re-prompt path. If the only way to withdraw consent is to clear cookies manually, the page is flagged.
Banner ignores the browser opt-out signal
What goes wrong
Modern browsers can send a one-click "do not track me" preference (called Global Privacy Control, or GPC). Many banners load before checking for the signal, or check and then ignore it - asking the user to opt out a second time, manually.
What AuditHQ checks
We send the GPC signal during the scan and check whether the banner acknowledges it before any trackers fire. Banners that ignore the signal, or never check for it, are flagged.
Findings are signals, not legal advice. Create an account to start a Full Audit with evidence of visible consent-flow gaps and a prioritised action plan for review with a privacy or legal advisor.
Start Full AuditCookie consent banner sets analytics cookies before user consents
Evidence
Network log shows _ga, _gid, and _gtm cookies set on first page load - before the consent banner button is clicked. The banner exists but is decorative; cookies are set unconditionally. This is a known consent-flow gap relevant to GDPR and the EU Cookie Directive and should be reviewed by a legal advisor.
Recommended fix
1) Move all analytics/advertising scripts behind consent gating. 2) Use a CMP (Consent Management Platform) that loads scripts only after explicit accept. 3) For Vercel/Next.js, conditionally render <Analytics /> based on consent state stored in localStorage.
Business impact
Consent-flow gaps can create legal, procurement, and trust friction. Treat this as a visible risk signal and review it with your legal or privacy advisor.
Fictional example of the evidence, fix and impact structure. It is not a current report or a finding about your site.
Questions, answered.
What buyers ask before running their first privacy audit.
Stop reading. Start auditing.
Audit your privacy stack now.
Create an account to start a Full Audit. This suite includes 59 catalogue checks; applicability depends on your site and scope. Review recorded evidence and a prioritised action plan.