Is your website’s tracking legal?

In the EU/EEA, national rules implementing the ePrivacy Directive regulate storing or accessing information on a user's device. These rules extend beyond cookies. Where consent is required, it must meet the GDPR standard: freely given, specific, informed and unambiguous. Check the rules that apply to your market.

An active choice

Visitors must choose for themselves. Pre-ticked boxes, silence or continued browsing do not provide valid consent.

Understandable information

Explain the purposes of tracking and who uses the information. A vague reference to a “better experience” is not enough.

Choices by purpose

Consent must relate to specific purposes. Separate analytics from marketing, for example, so visitors can choose what they want.

A real option to say no

Rejecting should be as easy as accepting. Do not hide rejection behind extra clicks or make it harder to find.

Consent before relevant tracking

Technologies that require consent must be managed before storing or accessing information. The banner needs to control the tags.

The ability to change your mind

Withdrawing consent must be as easy as giving it. Keep consent settings accessible.

Your organisation must be able to demonstrate consent; this test does not check consent logs. A limited exemption applies to technology strictly necessary to provide a service the user explicitly requests, and to transmitting communications. Analytics or advertising being useful to a business does not make it strictly necessary. Processing personal data also requires a separate GDPR assessment.

Consent Mode communicates the user's choices to Google tags. The check looks for defaults before tags start and whether signals update on acceptance and rejection. The four main signals have different roles:

analytics_storage

Indicates whether storage for analytics, such as analytics cookies, is allowed.

ad_storage

Indicates whether storage for advertising, such as advertising cookies, is allowed.

ad_user_data

Indicates consent to send user data to Google for advertising purposes.

ad_personalization

Indicates consent to personalised advertising, including remarketing.

Basic consent mode blocks Google tags until consent. Advanced consent mode can load tags with denied signals and send cookieless requests before consent. A request to Google therefore does not automatically mean a cookie was set; the absence of cookies does not mean no information is sent.

A “denied” signal is not legal approval. Your configuration and data processing need to be assessed alongside the banner, purposes and information actually transferred. Google's signals do not automatically cover other tracking providers.

The result covers one URL and the browser sessions tested. Content behind a login, other pages, regional variations or tags triggered by scrolling and other actions may behave differently. If the consent platform is not recognised, some checks may be skipped. Unknown providers need review; they are not automatically unlawful.

The check does not assess your entire privacy policy, data processing agreements, consent records, legal bases or information forwarded on the server without being visible in the browser. A good result describes what the test observed; it does not certify that all tracking is lawful. Use technical findings alongside an assessment of your own data processing.