GDPR Kit GDPR Kit Guide

How the GDPR Kit works

The GDPR Kit scans your website URL and detects all cookies and third-party trackers present. It categorises them as essential, functional, analytics or marketing. It then generates all four compliance documents pre-populated with the actual trackers found on your site — not a generic template.

Why this matters: Generic privacy policy templates list every possible tracker whether you use it or not. The GDPR Kit only documents what is actually on your site — making your policy more accurate and credible.

Deploying your GDPR Kit documents

Step 1 — Privacy Policy and Cookie Policy

Create two new pages on your website: /privacy-policy and /cookies. Paste the generated content into each page. Add links to both pages in your site footer — they must be accessible from every page.

Step 2 — Consent Banner

Paste the consent banner HTML as the first element inside your body tag. Test it on a fresh browser session — you should see the banner before any analytics fires. Check in your browser developer tools (Network tab) that GA4 or your analytics platform does not appear until after you click Accept.

Step 3 — Connect your tag manager

If you use Google Tag Manager, create a Custom Event trigger listening for the consent_accepted event fired by the banner. Move all non-essential tags (analytics, advertising, heatmaps) to fire only on this trigger.

Step 4 — Data Processing Record

Keep the generated RoPA in your internal documentation. You do not publish this — it is an internal record required under Article 30 that you must produce on request from the ICO.

Blocking is the hard part, not banners

Nearly every non-compliant site already has a cookie banner. The banner is not the problem. The problem is that the trackers fire anyway, because a banner only asks — it does not block. Unless something actively prevents those scripts from executing, they run on page load exactly as they always did, and the banner becomes an expensive piece of theatre that documents your non-compliance rather than curing it.

There are three ways to make consent actually control what loads, and they are not equivalent.

1. Tag manager gating — the practical approach

Move every non-essential tag out of the page source and into your tag manager, then fire them only on a consent event. Nothing is in the HTML, so nothing can run on load. This is the approach the deployment steps above describe, and for most sites it is the right one.

2. Script type swapping

Change <script src="..."> to <script type="text/plain" data-src="...">. The browser will not execute a script of an unknown type. On consent, rewrite the type to text/javascript and the script runs. This works for hard-coded third-party scripts you cannot move into a tag manager.

3. Server-side conditional rendering

Do not emit the script tags at all unless the consent cookie says you may. The most robust option, because there is no client-side race condition, but it requires control of the templating layer.

What does not work: loading the script and "disabling" it afterwards. By the time your JavaScript runs, the third-party script has already been fetched — which means the visitor's IP address and referring URL have already been sent to a third party, and any cookies it sets have already been set. The transfer happened. There is nothing to undo.

Google Consent Mode: why the tags still load, and why that is intended

If you use Google's advertising products in the UK or EEA, Consent Mode is no longer optional — since March 2024 Google requires Consent Mode v2 signals for personalised advertising features to function. It confuses a lot of people, so it is worth being precise about what it does.

Consent Mode does not block Google's tags. The tags load, and they adjust their behaviour according to four consent signals you set:

SignalGoverns
analytics_storageWhether analytics cookies may be set
ad_storageWhether advertising cookies may be set
ad_user_dataWhether user data may be sent to Google for advertising
ad_personalizationWhether data may be used for personalised advertising

Two details decide whether an implementation is correct:

How to test it properly — the check that actually proves compliance

The deployment steps above describe checking the Network tab, and that is the right instinct. Here is the full procedure, in the order a regulator or a complainant would run it.

  1. Open a private window. Not your normal browser — you have consented before, and the cookie is still there. Every compliance check that fails to do this returns a false pass.
  2. Open DevTools → Application → Storage → Clear site data. Start genuinely clean.
  3. Load the page. Touch nothing. Do not dismiss the banner. Do not click anything.
  4. Application → Cookies, and Local Storage. Anything present now was set without consent. The only entries permitted at this point are strictly necessary ones — session, security, load balancing, and the consent cookie itself.
  5. Network tab, filter by domain. Which third parties were contacted before you clicked anything? Every one of them received the visitor's IP address and the URL they were on. Google Analytics, Meta, Hotjar, Google Fonts, YouTube — all count.
  6. Now click Reject all. Repeat steps 4 and 5. This is the test almost nobody runs, and it fails far more often than the accept path, because implementations are built and tested against Accept. Rejection must genuinely prevent everything non-essential.
  7. Reload after rejecting. The rejection must persist. A banner that reappears and re-fires the trackers on the next page view is not a rejection.
  8. Test the withdrawal route. Having accepted, can you find a way to change your mind? Article 7(3) requires that withdrawing consent be as easy as giving it — which means a persistent link or icon that reopens the preference panel from any page.
Test on a real phone, too. Banners frequently render differently on mobile, and the classic failure is that "Reject all" is pushed below the fold or off-screen while "Accept all" sits in the thumb zone. That is precisely the dark pattern regulators have fined for — and on a desktop monitor it is invisible.

Getting the cookie policy right, and keeping it right

A cookie policy is a factual inventory. It has to list, for every cookie: name, provider, purpose, type, and retention period. Vagueness is what makes most cookie policies non-compliant — "we use cookies to improve your experience" is not a purpose, and "some cookies come from third parties" is not a provider.

The real problem is drift

A cookie policy is accurate on the day it is generated and starts decaying immediately. Every one of these silently invalidates it:

None of these events prompts anyone to update the policy, and the policy is the document you will be asked to produce. Re-scan on a schedule — quarterly is a reasonable default — and re-scan after any site change, plugin update or campaign launch. The consent categories in the banner must match the cookies actually present; a category that no longer corresponds to anything real, or a cookie that belongs to no category, is a defect in both documents at once.

What goes in the Record of Processing Activities

The RoPA is internal — you never publish it — but it is the first document the ICO asks for, and "we don't have one" is a poor opening. Article 30 sets out what a controller's record must contain:

The exemption you probably do not have

Article 30 exempts organisations with fewer than 250 employees — but the exemption falls away if the processing is not occasional, is likely to result in a risk to rights and freedoms, or involves special-category data. A website running analytics and marketing continuously is not processing occasionally. Most small businesses that assume the exemption covers them are wrong about it.

The RoPA also has a use beyond compliance: it is the only document that answers, in one place, "what personal data do we actually hold and where is it?" — which is exactly the question you cannot afford to be researching from scratch when a subject access request arrives with a one-month clock running, or a breach with a seventy-two-hour one.

Publishing the policies: the small things that fail an audit

General information, not legal advice. This describes what UK GDPR, PECR and current ICO guidance require of a typical business website. It is not a substitute for advice on your specific circumstances — particularly if you handle special-category data, process at scale, or operate in a regulated sector.

Frequently asked questions

What documents does the GDPR Kit generate?

The GDPR Kit generates four documents: a Privacy Policy covering UK GDPR requirements including data categories, legal bases, retention periods and user rights; a Cookie Policy listing every cookie detected with name, provider, purpose and retention; a Cookie Consent Banner in ready-to-paste HTML and CSS; and a Record of Processing Activities (RoPA) as required by Article 30 of UK GDPR.

Do I need a lawyer to review the generated documents?

The generated documents follow current UK GDPR requirements and ICO guidance. For most small and medium businesses, they provide a solid compliance foundation without legal review. However, if your business handles sensitive data categories (health, financial, children's data), processes data at scale, or operates in regulated industries, legal review is advisable.

How do I deploy the consent banner?

The consent banner is provided as self-contained HTML and JavaScript. Paste it as the first element inside your body tag — before any other scripts. It will appear on every page load for new visitors and store consent in a cookie. Connect your analytics and marketing tags to fire only after the user accepts. The banner code includes instructions for connecting to Google Tag Manager.

Is having a consent banner enough to be compliant?

No. A banner only asks — it does not block. Unless something actively prevents non-essential scripts from executing, they still fire on page load and the banner documents your non-compliance rather than curing it. Trackers must be gated: moved into a tag manager and fired only on a consent event, given a script type the browser will not execute until consent is granted, or not rendered into the page at all until the consent cookie permits it.

Why is my analytics still loading after someone clicks Reject?

Almost always because the tag is hard-coded in the page source rather than gated behind the consent event, so it executes on load regardless of what the banner reports. Test it directly: open a private window, clear site data, load the page, click Reject all, then check the Network and Application tabs. The reject path is the one that most implementations fail, because they were built and tested against Accept.

Does Google Consent Mode block Google's tags?

No. The tags still load and adjust their behaviour according to four signals — analytics_storage, ad_storage, ad_user_data and ad_personalization. The default state must be set to denied before any Google tag loads; if the default arrives after the tag, the tag runs in granted mode. Note also that advanced mode transmits cookieless pings before consent is given, whereas basic mode sends nothing until consent — many sites are running advanced mode without having chosen it.

Do I have to publish the Record of Processing Activities?

No — it is an internal document, produced on request by the ICO. Article 30 exempts organisations with fewer than 250 employees, but the exemption is lost if the processing is not occasional, is likely to result in risk, or involves special-category data. A website running analytics and marketing continuously is not processing occasionally, so most small businesses do not qualify for the exemption they assume applies to them.

🔒 Generate GDPR Kit Now

Run the GDPR Kit and get actionable results in minutes. Pay as you go.

Generate GDPR Kit →

Related tools

About aiwebpageseo

aiwebpageseo.com is a data-driven SEO and AEO (Answer Engine Optimisation) platform providing a free suite of technical website tools. Rather than relying on AI-theorised assumptions, the platform analyses live URL performance, delivering objective diagnostics, page speed metrics, CLS debugging, and site crawl data alongside actionable technical tutorials.