How to audit a website for privacy compliance (GDPR / CCPA / Privacy Act 2026)

Why privacy is now a survival metric, not a compliance checkbox

Three things changed in the past 24 months:

1. GDPR enforcement caught up to ambition. Per the EDPB Enforcement Tracker, regulator fines crossed €1.7B in 2024, and the cases that landed hardest weren't ad-tech giants - they were SMBs with sloppy cookie banners. The CNIL alone has issued multiple six-figure fines against small French businesses for pre-consent Google Analytics.
2. Australia's Privacy Act review. The reform proposals from the Attorney-General's Department put a private right of action and uncapped statutory damages on the table. The small-business exemption (currently under A$3M turnover) is in the deletion column.
3. CCPA/CPRA in California has been enforceable since July 2023, and per the IAPP US Privacy Tracker the majority of US Americans now live in a state with a comprehensive privacy law.

Plus the buyer-trust angle: the Cisco 2024 Consumer Privacy Survey found that the majority of consumers said they wouldn't buy from a brand they don't trust with their data. Privacy isn't legal-team theatre anymore. It's a competitive position.

The 8 signals

1. Privacy Policy - exists, current, complete

What to check:

• File exists at /privacy or /privacy-policy and is linked from the footer
• "Last updated" date is within 12 months (older policies trigger regulator scrutiny)
• The policy explicitly states: who collects the data, what data, why (lawful basis under GDPR Article 6), retention period, named third parties, rights, contact, regulator path (OAIC / ICO / FTC / state DPA), children's data policy (COPPA / GDPR-K)

What most tools miss: the "named third parties" check. Generic policies say "we may share data with service providers." Modern regulators want the list. AuditHQ's Privacy suite cross-references your declared third parties against the trackers actually loaded on your site - discrepancies flag.

2. Cookie consent mechanism - CMP type and granularity

What to check:

• A Consent Management Platform script loads - Cookiebot, OneTrust, Osano, Iubenda, Termly, Cookieyes, Klaro, Didomi, or Sourcepoint. A homegrown banner is rarely sufficient in 2026.
• Banner offers genuine choice - Accept all, Reject all, and Customise. Not just "Accept" or "Got it."
• Granular categories - Necessary, Functional, Analytics, Marketing.
• The Reject button is visually equal to Accept. The EDPB Guidelines 03/2022 on dark patterns explicitly cite button-styling asymmetry as a violation, and the ICO's UK guidance is aligned.
• IAB TCF v2.2 string present in the page DOM or cookies.
• Google Consent Mode v2 - mandatory in EEA + UK + CH since March 2024 if you use Google services.
• Consent withdrawal - a persistent footer link to re-open the banner.

What most tools miss: dark-pattern detection. A "Reject all" hidden under "Customise" is not compliant, even if it technically exists.

3. Pre-consent tracking - the biggest legal risk

This is the GDPR/PECR risk that gets sites fined. Even if your cookie banner is perfect, if Google Analytics fires before the user clicks Accept, you're in breach. The CNIL has issued repeated rulings on this exact pattern.

What to check:

• Open the site in a private browser window
• DevTools → Network → filter "All"
• Reload the page, DO NOT click anything on the cookie banner
• Look for requests to: google-analytics.com, googletagmanager.com, facebook.com/tr, analytics.tiktok.com, bat.bing.com, etc.
• If ANY of these fire before consent, you have pre-consent tracking.

What most tools miss: this entirely. Static HTML scanners can see that GA is in the page; they can't see whether it fires before consent. AuditHQ flags the markup; deep pre-consent firing detection is a Cookie Deep-Dive add-on.

4. Tracker inventory - what's actually on your page

What to check: open DevTools → Network → filter for tracker domains. Common categories:

• Analytics: GA4, Mixpanel, Amplitude, PostHog, Plausible, Fathom, Microsoft Clarity, Heap, Tinybird/Flock
• Advertising: Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Reddit/Pinterest/Twitter/Snap pixels, Microsoft UET
• Session replay (highest risk): Hotjar, FullStory, LogRocket, Mouseflow, Microsoft Clarity
• Marketing automation: HubSpot, Marketo, Klaviyo, ActiveCampaign
• Helpdesk/chat: Intercom, Drift, Zendesk Widget, Tidio, Crisp

What most tools miss: the controller-vs-processor distinction. Meta Pixel is an independent controller - Meta processes data for its own purposes. GA4 is more clearly a processor if you've signed the Google Ads Data Processing Terms. The classification changes your liability - and your policy needs to reflect it. This compounds the technical-health and security stories - when your site loads dozens of third-party scripts blind, you're hitting both privacy and security risks at once. See the technical-health audit guide for the performance/security side.

5. Form lawful basis - consent or contract?

What to check:

• Newsletter / marketing forms have an unticked consent checkbox with explicit language: "Yes, send me marketing emails about your products."
• Contact forms have a privacy link near the submit button.
• Account-creation forms link to ToS and Privacy Policy and require the user to accept (clickwrap, not browsewrap).

What most tools miss: the unticked-checkbox check. Pre-ticked consent is explicitly invalid under GDPR per the CJEU's Planet49 ruling (C-673/17, 2019). Many SMBs still use pre-ticked checkboxes by default.

6. Multi-jurisdiction coverage

If you sell to multiple regions, your privacy policy needs to address each. The big six in 2026:

You don't need separate pages per region. One policy with regional addenda works fine.

7. DSAR mechanism - Data Subject Access Request path

GDPR Articles 15-21 give EU users the right to access, correct, delete, and port their data. CCPA gives California users similar rights. The Privacy Act gives Australians similar rights via the APP 12 / 13 access and correction principles.

What to check:

• A specific URL or email for DSAR requests (not just info@yourdomain.com)
• The privacy policy explains how to make a request, the response time (30 days for GDPR), and verification
• Ideally a self-service portal (Iubenda, Termly, OneTrust all offer this)

What most tools miss: the response-time commitment.

8. Modern signals - Consent Mode v2, GPC, Privacy Sandbox

• Google Consent Mode v2 - mandatory in EEA/UK/CH since March 2024.
• Global Privacy Control (GPC) - a browser signal (sent via Sec-GPC: 1 header). Legally binding in California per CA AG enforcement guidance.
• Privacy Sandbox / Topics API - Chrome's replacement for third-party cookies.
• Apple App Tracking Transparency (ATT) - if you have a mobile app linked from your site, reference how ATT applies.

Worked example - a real SMB we audited

Composite score: 58/100 - Grade C

The site is genuinely better than most small Australian businesses - privacy policy, cookie banner with Accept/Decline, GA4 Consent Mode v2 implemented with denied defaults, and the policy is plain-English and dated within the last 12 months. Real positives.

But the audit also surfaced:

• Pre-consent tracking, twice. A second analytics tool (Tinybird via a self-proxied /~flock.js) fires a page_hit event on every page load with no consent gate - IP-derived country, user-agent, referrer, page URL, session ID. Separately, GA4's script tag itself loads unconditionally in <head> before consent resolves.
• Tinybird/Flock not disclosed. Not named anywhere in the policy. Under APP 1 and GDPR Article 13, a third-party processor handling personal information needs to be disclosed.
• No legal basis in the policy. Says what and why but not the lawful basis (contractual necessity / legitimate interest).
• No formal DSAR process. "You may request deletion" - no process, no timeline, no required info.
• No OAIC complaint mechanism. APP 1 requires it.
• Custom banner, not a CMP. Binary accept/decline, no category granularity, no audit log, no auto-scanner, no geo-detection.
• Google Fonts loads unconditionally, transmitting visitor IP to Google US - flagged in German court rulings as an unlawful EU data transfer.

Score breakdown

The three fixes that close most of the exposure:

1. Replace the custom banner with Cookiebot or Osano (~AU$20/month). A 2-3 hour developer task. Solves pre-consent firing, adds an audit log, brings category granularity.
2. Update the policy in four short paragraphs: legal basis statement, formal DSAR process with a 30-day SLA, OAIC complaint pathway, Tinybird + Cloudflare added to third-party list. About 90 minutes of writing.
3. Add a consent gate to the second analytics tool, or remove it entirely if it isn't driving decisions. 1-2 hours of dev work.

Why this matters for a service business: the business runs on enquiries. Customers share their event details, location, contact information, and budget through a contact form. The reputational damage from a privacy complaint becoming public in a tight-knit local market would dwarf the cost of the fixes above - and as we covered in the reputation audit guide, public reputation damage in a small market compounds fast. The same business's missing email auth (SPF, DMARC) - covered in the security audit guide - multiplies the risk further.

Run it on your site automatically

Privacy compliance is not a one-time fix - it's a posture you maintain. The AuditHQ Privacy suite reviews visible privacy signals and supporting evidence to help you prioritise a review with a qualified advisor. Automated findings do not establish legal compliance.

FAQ

Written by Adam Savage, Founder of AuditHQ - 17 years building digital products. Last updated 5 October 2026.

This article is observational and not legal advice. Compliance depends on jurisdiction, data flows, and processing purposes that only you and your legal counsel can confirm.