GDPR website audit: the practical checklist to see whether yours is already compliant
Do you have a site or an online shop and wonder whether it's genuinely fine on privacy? A GDPR website audit is the step nearly everyone skips: you publish, you add a cookie banner found online and convince yourself that's enough. It often isn't. In this guide we look at how to check whether a site is GDPR compliant with a point-by-point checklist, a few manual tests you can run today, and the limits of DIY checking.
A useful caveat: this isn't about what you need in order to be compliant (for that, see the complete guide on making a GDPR compliant website), but about how to check whether you already are. It's an audit, not a manual of obligations.
Why run a GDPR audit of your site
The GDPR doesn't ask for a badge or a certification: it asks that you handle visitors' data transparently and with their consent where required. The problem is that many violations aren't visible to the eye. A site can look perfect and still load Google Analytics, the Meta pixel or a Google map before the user has clicked "Accept".
That's even more true for anyone who built the site themselves or with the help of AI (vibe coding): templates and generators often ship trackers and external fonts "as standard", without asking your permission. That's why a periodic GDPR check of your site makes sense even if you think you're already compliant.
GDPR audit checklist: the 6 fundamental checks
Here's the checklist to follow in order. You can run it on any site, yours or a client's, in about ten minutes.
- Does the privacy policy exist and is it reachable? It must be linked from every page (usually in the footer) and open with one click, without logging in. If you can only find it by searching Google, for the average user it may as well not exist.
- Does the privacy policy say the right things? It must state who the controller is (name/company name and a real contact), what data you collect, why and for how long, plus the user's rights. A generic policy copied from another site, with another company's name inside, doesn't count.
- Is there a separate cookie policy? The cookie policy lists the cookies and trackers in use and their purposes. It can be a dedicated section or a separate document, but it must exist and be linked from the banner.
- Does the cookie banner actually block trackers before consent? This is the most important check and the one most often failed. The banner mustn't just appear: it must prevent analytics and pixels from loading until the user accepts. We'll see how to test it shortly.
- Are the consent boxes unticked? Consent must be active. If you open the banner and find "statistics" or "marketing" already ticked, or if "Accept all" is prominent while "Reject" is hidden or absent, that isn't valid consent.
- Is the controller identified and is there a contact? The user must be able to understand who they're dealing with and how to exercise their rights (access, erasure, objection). At minimum you need an email address or a contact form.
If even one of these points is red, your site has a compliance gap to fix.
How to check whether a site is GDPR compliant: the manual tests
The checklist tells you what to look at. Now let's see how to check it properly, because on a couple of points the eye isn't enough.
Test 1: open the site in incognito and watch what fires
This is the decisive test on cookie consent. Open a window in private browsing (so you start with no saved cookies) and go to your site. Don't click anything on the banner: leave it there.
Then open the browser's developer tools (F12, or right-click → "Inspect") and go to the Network tab. Reload the page. You'll see the list of every request the site makes. Look for calls to domains like google-analytics.com, googletagmanager.com, facebook.net, doubleclick.net, hotjar, or external fonts and maps.
If you see those trackers fire before you've clicked "Accept", the banner is decorative: it collects consent but doesn't honour it. It's one of the most common and most penalised forms of non-compliance.
Test 2: check the stored cookies
Still in the developer tools, go to the Application tab (or "Storage") and open the Cookies section. Here you see every cookie the site has written to the browser. Before accepting, there should only be strictly necessary technical cookies. If you already find profiling or analytics cookies, that confirms the problem from Test 1.
Test 3: try the "Reject" button
Refusing cookies must be as easy as accepting them. Click "Reject" (if there is one) and rerun Test 1: no marketing or analytics tracker should fire. If everything keeps loading after the refusal, the consent is being ignored.
For an online shop these checks are even more delicate, because on top of cookies you have customer accounts, payment data and newsletters: if you run a store, it's worth digging into the dedicated guide to GDPR for e-commerce.
The limits of DIY checking
The manual tests are great for getting a sense of things, but they have three concrete limits.
The first is coverage: you check the home page, but the problematic tracker may only fire on the product page, at checkout or in an article with an embedded video. Testing every page by hand is long and you always forget something.
The second is technical skill: reading the Network tab, telling a technical cookie from a profiling one and understanding which script loads what isn't immediate for someone outside the field.
The third is continuity: a site that's compliant today won't be forever. You add a plugin, a pixel for a campaign, a new chat tool, and you reintroduce a tracker without noticing. The audit should be repeated with every change.
This is where an automated scanner comes in. A tool like Appurai analyses the site page by page, detects trackers firing before consent, flags missing or non-compliant privacy policies and cookie banners, and also identifies security flaws you wouldn't spot by eye. In practice it automates the whole checklist above and gives you the list of problems in minutes, without opening developer tools. The free version shows you what's wrong; if you want, the higher tiers explain how to fix it and generate the missing documents.
What to do after the audit
Once the audit is done you have a list of gaps. The order of priority is nearly always the same:
- Block trackers before consent — this is the highest fine-risk point.
- Fix or create the privacy policy, if missing or generic. If you have doubts about the obligation, here's why a website privacy policy is required.
- Add the cookie policy and link it from the banner.
- Fix the banner: no pre-ticked boxes, a clearly visible "Reject" button.
You don't have to do it all in a day, but the first two points are worth tackling right away.
Frequently asked questions
How often should a GDPR website audit be done?
At least once a year and every time you add features, plugins or marketing tools. Every change can reintroduce a tracker or change the data you collect.
Is an online GDPR test enough to be sure I'm compliant?
An automated test covers the technical side and gives you a far more complete picture than checking by hand. It doesn't replace a legal assessment of your specific situation, though, especially for unusual processing.
Does a cookie banner protect me on its own?
No. The banner only counts if it genuinely blocks trackers before consent and lets people refuse as easily as they accept. A banner that appears but lets everything fire is worthless.
Does this apply to a small site or one built with AI?
Yes. The GDPR applies to anyone processing the data of users in the EU, regardless of size. If anything, sites created with templates or AI generators often have trackers active "by default" without the owner knowing.
What do I risk if the site isn't compliant?
Beyond possible fines, you risk user complaints and reputational damage. The most exposed point is processing data without a valid basis, such as trackers loaded before consent.
This article is informational and does not constitute legal advice. For an assessment of your specific situation, consult a professional.