Why you need a compliance checklist
GDPR cookie enforcement isn't theoretical. The French CNIL fined Google 150 million euros for cookie violations. The Italian Garante fined a publisher 20,000 euros for missing a reject button. The Belgian DPA ordered a major news site to redesign its consent flow from scratch.
These fines share a pattern: the website owners thought they were compliant. They had a cookie banner. They had a privacy policy. But they missed specific requirements that regulators actually check.
This checklist covers what regulators look for. Work through it once, then schedule quarterly re-checks. Cookie compliance isn't a one-time setup; it drifts as you add tracking scripts, change vendors, and update your site.
The checklist
Each step includes what to check, why it matters, and how to verify it. Steps are ordered by risk: the first items are the ones most likely to draw a fine.
Prior consent before non-essential cookies
No analytics, marketing, or preference cookies fire before the visitor clicks Accept
Open DevTools > Application > Cookies before interacting with the banner. If you see Google Analytics, Meta Pixel, or HubSpot cookies already set, you're violating Article 5(3) of the ePrivacy Directive. CookieBeam blocks these automatically until consent is granted.
Google Consent Mode defaults are set to 'denied' for analytics_storage and ad_storage
Check your page source or GTM preview for the gtag('consent', 'default', ...) call. Both analytics_storage and ad_storage must start as 'denied'. CookieBeam sets these defaults automatically.
Third-party scripts don't load until consent is given for their category
Use the Network tab in DevTools to watch requests before and after accepting cookies. Scripts like chat widgets, heatmaps, and ad pixels should only appear after consent.
Cookie categorization
Every cookie on your site is assigned to a category
Run a cookie scan (CookieBeam does this automatically with AI classification). Unknown cookies are a compliance gap because visitors can't make an informed choice about something you haven't categorized.
Categories match the standard GDPR grouping: Necessary, Analytics, Marketing, Preferences
Don't invent categories like 'Performance' or 'Experience' that blur the line between analytics and necessary. Regulators expect the standard four.
Necessary cookies are genuinely necessary (session tokens, CSRF, load balancers)
Don't classify analytics or marketing cookies as 'necessary' to avoid consent. Regulators check this. If a cookie isn't required for the site to function, it needs consent.
Banner design and user experience
The reject button is as prominent and accessible as the accept button
Same size, same visual weight, same number of clicks to reach. Hiding 'Reject' behind a 'Manage preferences' link while 'Accept all' is a big green button is a dark pattern that regulators actively fine for.
The banner doesn't use manipulative language or design (dark patterns)
No guilt-tripping ('You'll miss out on a personalized experience!'). No pre-checked boxes. No confusing double negatives. No color tricks that make 'Accept' stand out while 'Reject' blends into the background.
The banner appears before any non-essential processing happens
The banner must load and block tracking before analytics scripts fire. If your banner loads after a 3-second delay, you've already violated consent for those 3 seconds.
The banner is accessible (keyboard navigable, screen-reader compatible, sufficient contrast)
WCAG 2.1 AA compliance isn't optional for consent mechanisms. Users with disabilities must be able to exercise their cookie choices equally.
Consent records and proof
Every consent decision is logged with a timestamp, consent ID, and the choices made
If a regulator asks 'prove this visitor consented to marketing cookies on June 15th,' you need to produce that record. CookieBeam logs every consent event automatically.
Consent records include which version of the banner was shown
If you changed your banner text or categories between when consent was given and when you're audited, you need to show what the visitor actually saw and agreed to.
Cookie policy and transparency
Your cookie policy lists every cookie by name, purpose, category, duration, and provider
A generic 'we use cookies to improve your experience' page isn't a cookie policy. List each cookie specifically. CookieBeam's scanner generates this inventory automatically.
The cookie policy is linked from your banner and easily accessible from every page
Usually in the footer and in the banner's 'more information' link. Visitors should be able to find it without accepting cookies first.
Visitor rights and preference management
Visitors can change or withdraw consent at any time without navigating away from the page
A floating settings button or footer link that re-opens the consent preferences panel. Withdrawing consent must be as easy as giving it (GDPR Article 7(3)).
Withdrawing consent actually stops the processing
When a visitor changes their mind and rejects marketing cookies, those cookies must be deleted and the tracking scripts must stop. Verify this in DevTools.
You can respond to data subject access requests (DSARs) related to cookies
If a visitor asks 'what data have you collected about me through cookies,' you need a process to answer. Consent logs, analytics data tied to their consent ID, and cookie inventories are the typical evidence.
Vendor management and data processing
You have a Data Processing Agreement (DPA) with every vendor whose cookies or scripts appear on your site
Google Analytics, Meta, HubSpot, Hotjar, Intercom: every third-party service that processes visitor data needs a DPA. Most major vendors provide standard DPAs, but you need to have them signed and filed.
Your sub-processor list is published and up to date
GDPR requires transparency about who processes data on your behalf. List your cookie-related sub-processors in your privacy policy or a dedicated sub-processors page.
Technical implementation
Cookie scanning runs on a regular schedule (weekly or after every deployment)
New scripts get added by marketing teams, plugin updates, or A/B testing tools without going through compliance review. Automated scanning catches these before they become violations.
Google Consent Mode v2 is implemented in Advanced mode (not just Basic)
Basic mode blocks all Google tags until consent. Advanced mode sends cookieless pings to Google for conversion modeling, preserving ad measurement while respecting consent. Google requires Consent Mode v2 for EEA audiences.
Cross-border data transfers are addressed (Standard Contractual Clauses for US vendors)
If your analytics or marketing vendors transfer data to the US (Google, Meta, most SaaS), you need SCCs or another GDPR Chapter V mechanism in place.
Ongoing maintenance
Quarterly compliance audits are scheduled
Re-run the cookie scan, review consent rates, check for new third-party scripts, verify banner functionality after site updates. Cookie compliance drifts; quarterly checks catch it.
Your team knows who's responsible for cookie compliance
Someone owns the consent banner, the cookie policy, and the vendor DPA list. If nobody does, compliance gaps accumulate silently until a regulator or a visitor complaint surfaces them.