GDPR Auditor GDPR Guide

The most common GDPR failures on business websites

1. Analytics firing before consent

The most common failure by far. Google Analytics, Facebook Pixel and other tracking scripts must not fire until the user has actively accepted cookies. If your analytics loads on page load before any cookie banner interaction, you are non-compliant. Fix this in Google Tag Manager by triggering analytics tags only after a consent_update event.

2. Cookie banner with no reject option

A banner that only has an Accept button is non-compliant. The ICO requires that rejecting cookies is as easy as accepting them. Add a clear "Reject all" option at the same level as "Accept all" — not buried in a settings menu.

3. Missing cookies policy

A privacy policy is not sufficient — you need a separate cookies policy that lists every cookie used, its name, purpose, provider and retention period. Your consent banner must link to this policy.

4. No record of consent

You must be able to prove consent was given if challenged. Your consent management platform should log when consent was given, what version of the policy was shown, and what the user consented to.

How to audit your GDPR compliance

Run the GDPR Auditor — it checks for cookie banners, analyses which trackers load before consent, validates your privacy policy presence and checks security headers. The audit is free and takes under a minute.

Quick fix: Use the GDPR Kit tool to generate a compliant privacy policy, cookies policy and consent banner HTML for your specific site. It scans your trackers and creates documentation tailored to what your site actually uses.

Cookies are not governed by GDPR — and that distinction changes what you must do

This is the single most consequential misunderstanding in website compliance, and almost every "GDPR cookie banner" article gets it wrong.

In the UK, the rules on storing or accessing anything on a user's device — cookies, localStorage, sessionStorage, pixels, device fingerprinting — come from PECR (the Privacy and Electronic Communications Regulations), not from UK GDPR. In the EU the equivalent is the ePrivacy Directive. UK GDPR then governs what you do with the personal data those technologies collect.

Why does this matter in practice? Because PECR requires consent for anything that is not strictly necessary — and it does not offer the alternative lawful bases that GDPR does. This closes the loophole that a great many sites believe they are using:

You cannot use "legitimate interests" to avoid asking for cookie consent. Legitimate interests is a lawful basis under GDPR Article 6 for processing personal data. It is not available under PECR for setting a cookie. If a consent management platform or an agency has told you that analytics can run on legitimate interests without consent, that advice is wrong, and it is the most common single point of non-compliance on British business websites.

"Strictly necessary" is much narrower than people assume

The exemption covers storage that is essential to provide a service the user has explicitly requested. That is a short list:

Analytics is not on that list. The ICO has been explicit about this. The user did not request analytics; you did. However genuinely useful your traffic data is to you, and however anonymised it may be, the cookie still requires consent before it is set. "But it's only first-party analytics" and "but we've turned on IP anonymisation" are both true and both irrelevant to whether consent is needed.

What makes consent valid, and what invalidates it

Consent under UK GDPR has a definition, and it is specific: freely given, specific, informed, and unambiguous, given by a clear affirmative action. Each of those words has been litigated, and each of them kills a common banner design.

PatternVerdictWhy
Pre-ticked consent boxesInvalidNot a clear affirmative action (settled by the CJEU in the Planet49 case, 2019)
"By continuing to browse you accept"InvalidInactivity and scrolling are not consent
Accept button prominent, Reject buried in a settings menuInvalidRejection must be as easy as acceptance — regulators have fined for exactly this
Cookies set before the banner is answeredInvalidConsent must precede the storage, not follow it
No way to withdraw consent laterInvalidArticle 7(3): withdrawal must be as easy as giving
A single "Accept all" with no granularityUsually invalidConsent must be specific to each purpose

The withdrawal requirement that everybody forgets

Article 7(3) requires that withdrawing consent be as easy as giving it. A banner the user can dismiss in one click, with no mechanism ever to change their mind, fails this. You need a persistent, findable route back — a "Cookie settings" link in the footer, or a small persistent icon — that reopens the preference panel on any page. Most sites deploy a compliant banner and then omit the withdrawal path entirely.

Consent expires

Consent is not permanent. Regulator guidance is that it should be refreshed at reasonable intervals rather than stored indefinitely — a banner that asks once in 2021 and never again is not standing on solid ground. Re-prompting somewhere in the range of six to twelve months is the common interpretation. Check current ICO guidance rather than relying on whatever default your consent platform shipped with.

The trackers that are invisible until someone complains

Most sites underestimate what is loading, because much of it was added by a plugin, a theme, or an embed that nobody audited.

How to see the truth in two minutes: open the site in a private window, open DevTools, go to the Application tab, and clear all storage. Reload — and without touching the banner, look at Cookies and Local Storage. Everything sitting there was set without consent. Then look at the Network tab and see which third-party domains were contacted. This is exactly what a complainant or a regulator will do, and it takes no specialist knowledge.

Obligations beyond the banner

The cookie banner is the visible part, so it absorbs all the attention. Several other obligations are less visible and more likely to be missed entirely.

Subject access requests

Anyone can ask what personal data you hold on them, and you must respond within one month. This can be extended by two further months where the request is complex, but you must tell the individual within the first month that you are extending and why. It is free — you can only charge where a request is manifestly unfounded or excessive. There is no form and no required wording: a request can arrive as a sentence in an ordinary email, and the clock starts when it lands.

Breach notification: 72 hours

A personal data breach that poses a risk to individuals' rights and freedoms must be reported to the ICO within 72 hours of becoming aware of it. Where the risk is high, the individuals themselves must also be told, without undue delay. Seventy-two hours is not long to discover what happened, assess it and file — which is why an incident procedure written in advance is worth more than one improvised on a Friday night.

Processor contracts (Article 28)

Every organisation that processes personal data on your behalf — your host, your email platform, your analytics provider, your CRM, your backup service — must be under a written contract meeting Article 28. Most large vendors publish a standard Data Processing Addendum. You are still responsible for having accepted it.

Records of processing (Article 30)

There is an exemption for organisations under 250 employees — but it evaporates if the processing is not occasional, is likely to result in risk, or involves special-category data. Analytics and marketing on a live website is continuous, not occasional. Most small businesses therefore do not qualify for the exemption they assume covers them.

The ICO data protection fee

Most UK organisations processing personal data must pay an annual data protection fee to the ICO, on a tiered scale by size and turnover, unless they qualify for an exemption. It is straightforwardly missed by small businesses who have never heard of it. The ICO publishes a self-assessment for determining whether you owe it and how much — use that rather than a figure quoted second-hand.

International transfers and the US question

The moment a visitor's IP address reaches a server outside the UK, you are making a restricted international transfer, and you need a lawful mechanism for it. Since almost every analytics, advertising and font provider is American, this affects nearly every site.

The mechanisms available:

This area has been unstable for a decade — two previous US adequacy arrangements were struck down in court — and it is one where it is genuinely worth checking the current position rather than relying on documentation written a year ago.

Email marketing: a separate set of rules again

Marketing email is governed by PECR, not by GDPR's lawful bases, and the rule is opt-in consent — with one narrow and widely-misapplied exception.

The soft opt-in permits you to email an existing customer about similar products or services, provided you obtained their details in the course of a sale or negotiations for a sale, and you gave them a simple means of opting out at the point of collection and in every message since.

What the soft opt-in does not cover, despite constant claims to the contrary:

And an unsubscribe link is required in every marketing message, unconditionally — including the ones sent under the soft opt-in.

General information, not legal advice. The above describes what the UK GDPR, PECR and current ICO guidance require of a typical business website. It is not a substitute for advice on your specific circumstances — particularly if you process special-category data such as health or children's data, operate at scale, or work in a regulated sector.

Frequently asked questions

Does GDPR apply to my website?

GDPR applies to your website if you process personal data from people in the UK or EU. Personal data includes names, email addresses, IP addresses, and cookie identifiers. If your site has a contact form, uses Google Analytics, has a newsletter signup, or shows personalised ads — GDPR applies. In practice, almost every website with any interactive element is covered.

What must a cookie consent banner do to be legal?

A compliant cookie consent banner must: appear before any non-essential cookies are set, clearly explain what cookies are used for, provide an equally easy way to reject all cookies as to accept all cookies, not use dark patterns that make rejection harder than acceptance, and record consent so you can prove it was given. Pre-ticked boxes, reject options buried in settings menus, and banners that fire analytics before consent are all non-compliant.

What must my privacy policy include?

Under UK GDPR, your privacy policy must include: what personal data you collect and why, the legal basis for processing, how long you keep data, who you share it with, whether data is transferred outside the UK/EU, users' rights (access, rectification, erasure, portability), how to complain to the ICO, and contact details for your data controller.

Can I run analytics under legitimate interests instead of asking for consent?

No. Setting a cookie or accessing storage on a user's device is governed by PECR, not by the GDPR lawful bases, and PECR requires consent for anything that is not strictly necessary. Legitimate interests is a GDPR basis for processing personal data and is not available as an alternative to cookie consent. The ICO is explicit that analytics is not strictly necessary, because the user did not request it.

Which cookies are exempt from consent?

Only those strictly necessary to deliver a service the user has explicitly requested: a shopping basket remembering its contents, a session cookie keeping a logged-in user logged in, security tokens, load balancing, and the cookie that stores the user's own consent preferences. Analytics, advertising, heatmaps and social widgets are not exempt, regardless of whether the data is anonymised.

How long do I have to respond to a subject access request?

One month from receipt. This can be extended by up to two further months where the request is complex, but you must tell the individual within the first month that you are extending and explain why. There is no fee unless the request is manifestly unfounded or excessive, and no prescribed format — a request made in an ordinary email is still valid and starts the clock.

Are embedded Google Fonts and YouTube videos a compliance problem?

They can be. Loading fonts from Google's servers transmits the visitor's IP address to a third party before any consent is given — a German court ruled in 2022 that doing so without consent was unlawful. Self-hosting the fonts removes the issue entirely and is faster. A standard YouTube embed likewise contacts Google and sets cookies on load; use a click-to-load placeholder so nothing is requested until the user chooses to play the video.

🔒 Run GDPR Audit Now

Run the GDPR Auditor and get actionable results in minutes. Pay as you go.

Run GDPR Audit →

Related tools

About aiwebpageseo

aiwebpageseo.com is a data-driven SEO and AEO (Answer Engine Optimisation) platform providing a free suite of technical website tools. Rather than relying on AI-theorised assumptions, the platform analyses live URL performance, delivering objective diagnostics, page speed metrics, CLS debugging, and site crawl data alongside actionable technical tutorials.