AuditAI: False Positives Explained

16 October 2026 · By John Carlsson

AuditAI said it found 3 issues on my site, showed 2 and held the third back until I joined its waitlist. Both issues it showed were false positives: it said the site had no cookie consent when it has its own UK GDPR and PECR consent banner that stops Google Analytics loading until the visitor agrees, and it flagged a missing California "Do Not Sell" link for a UK business that California's privacy law does not apply to.

What happened

On 16 October 2026 I ran aiwebpageseo.com through AuditAI (auditai.fyi). It said: "We found 3 issues on your site." It showed 2 of them. To see the third, it asks you to join its "Private Beta Waitlist" with your email address, and offers to move you 50 places up the list if you share your scan on X or LinkedIn.

I checked both issues it showed against the live files on my site.

The short version

"No Cookie Consent Mechanism Detected", rated High Impact. The site has its own consent banner and Google Analytics does not load until the visitor agrees. False positive.
No "Do Not Sell or Share My Personal Information" link, rated Low Impact. California's CCPA does not apply to this business. False positive.
The third issue. Only shown after joining the waitlist, so it could not be checked.

False positive 1: "No Cookie Consent Mechanism Detected"

AuditAI said: "No recognized cookie-consent banner or consent-management platform was detected on this page. If the site sets non-essential cookies (analytics, ads, tracking), GDPR requires opt-in consent before they're set, and India's DPDP Act has similar consent requirements."

What the site actually does. aiwebpageseo.com has its own site-wide cookie consent banner, built for UK GDPR and PECR and loaded on every page. Google Analytics is the only non-essential cookie on the site, and it does not load until the visitor agrees to analytics. If the visitor has not agreed, Google Analytics is never loaded and no analytics cookies are set.

Why AuditAI got it wrong. AuditAI only looks for known consent platforms and common banner markers. Its own report admits it "can miss a custom-built consent flow, so verify manually if you have one". That is exactly what happened. It did not recognise a custom-built banner, reported that the site had no consent at all, and still rated it High Impact.

It also quoted the wrong law. For a UK website, the rules on cookies are in the Privacy and Electronic Communications Regulations (PECR), which the ICO enforces alongside UK GDPR. AuditAI named EU GDPR and India's DPDP Act. Its own page says "AuditAI evaluates sites against GDPR, CCPA, and DPDP". PECR is not on that list.

False positive 2: no "Do Not Sell or Share My Personal Information" link

AuditAI said: "CCPA (California) requires businesses that sell or share personal information above certain thresholds to provide a clear opt-out link, typically labeled 'Do Not Sell or Share My Personal Information' or 'Your Privacy Choices'. No such link was found."

What the law actually says. The California Consumer Privacy Act only applies to for-profit businesses that do business in California and meet at least one of these tests:

annual gross revenue of more than 25 million US dollars, a figure now adjusted for inflation
buying, selling or sharing the personal information of 100,000 or more California consumers or households
making 50 percent or more of their yearly revenue from selling or sharing personal information

AI Web Page SEO is a one-person UK pay-as-you-go audit service. It meets none of these tests, and it does not sell or share anyone's personal information.

Why AuditAI got it wrong. AuditAI's own report says: "This only applies if your business meets CCPA's applicability thresholds." It did not check whether the business meets them, and listed the missing link as an issue anyway.

The third issue

AuditAI said there were 3 issues but only showed 2. The third is only shown after joining its waitlist, so it could not be checked.

The same page says "19 developers secured Priority Access in the last 24 hours". The page gives no way to check that figure, for a tool that got both of the issues it showed wrong.

This is as much as I am prepared to report on this site as it clearly is wrong and on sites like this I just do not have the time to dig deeper.

How to read any automated privacy report

Check each finding against your own site before you act on it. A check that only looks for known products will always miss anything custom-built.
Check which country's law it is quoting. A UK site needs PECR and UK GDPR, not a list of other countries' laws.
Check whether the law applies to you at all. Many laws only apply above a size or revenue threshold.
If the free part of a report is wrong on every issue it shows, there is no reason to hand over your email address to see the rest.

This review is part of our series False Positives in Audit Tools, where other tools' reports are checked against the published rules.

Sources

Frequently asked questions

Is AuditAI accurate?

On my site it was not. It showed 2 issues and both were false positives. It reported no cookie consent when the site has its own consent banner that stops Google Analytics loading until the visitor agrees, and it flagged a missing California opt-out link for a UK business that does not meet any of the CCPA thresholds. The third issue was held back until joining its waitlist, so it could not be checked.

Does a UK website need a "Do Not Sell or Share" link?

Only if the business meets the California Consumer Privacy Act tests. The law applies to for-profit businesses doing business in California that have more than 25 million US dollars a year in revenue, adjusted for inflation, or buy, sell or share the personal information of 100,000 or more Californians, or make half their revenue from selling or sharing personal information. A small UK business that meets none of these does not need the link.

Which law covers cookies on a UK website?

The Privacy and Electronic Communications Regulations, known as PECR, set the rules on cookies and similar technologies in the UK, and UK GDPR covers the personal data those cookies collect. Both are enforced by the Information Commissioner's Office. A report that only quotes EU GDPR, California's CCPA and India's DPDP Act is not checking a UK site against the UK rules.