# Cookie compliance audit
> Source: https://legalcode.md/skills/legalcode-cookie-compliance-audit | [HTML version](https://legalcode.md/skills/legalcode-cookie-compliance-audit)

Audit cookie and tracking technology implementations for ePrivacy Directive and GDPR compliance.

Audit cookie and tracking technology implementations for ePrivacy Directive and GDPR compliance. Tests consent banner functionality including pre-consent cookie blocking, granular category controls, reject-all parity with accept-all, consent withdrawal mechanisms, and consent record retention. Identifies tracking technologies beyond cookies (pixels, fingerprinting, local storage, ETags). Evaluates compliance with CNIL, ICO, and EDPB guidance on cookie walls, analytics exceptions, and essential cookie classifications. Covers US state requirements (CCPA opt-out signals, Global Privacy Control, and state universal opt-out mechanisms). Produces remediation checklist with technical implementation guidance and confidence-scored compliance findings. Use when auditing a website, mobile app, or digital platform for cookie consent compliance, preparing for supervisory authority review, or assessing a consent management platform (CMP) implementation.

This skill conducts a systematic audit of cookie and tracking technology implementations against ePrivacy Directive Article 5(3), GDPR consent conditions, EDPB guidance, and applicable national supervisory authority requirements. It identifies specific compliance failures, classifies their severity, and produces a prioritised remediation checklist with technical implementation guidance. **Covers:** - Pre-consent blocking verification (scripts, pixels, SDKs firing before consent) - Consent banner UX compliance (reject-all parity, dark patterns, information adequacy) - Cookie category classification (strictly necessary vs. analytics vs. marketing) - Granular category controls (per-category toggles, independence testing) - Withdrawal mechanism availability and effectiveness - Consent record retention requirements (Article 5(2) GDPR accountability) - Tracking technology scope beyond HTTP cookies (pixels, local storage, fingerprinting, ETags, server-side tagging, CNAME cloaking) - Analytics cookie exemption eligibility (CNIL France, ICO UK post-DUAA) - Cookie wall and "consent or pay" analysis (EDPB Opinion 08/2024) - Google Consent Mode v2 signal accuracy (mandatory since March 2024) - US state requirements: CCPA opt-out of sale/sharing, GPC mandatory honoring, state UOOM compliance - IAB TCF v2.2 / Global Privacy Platform (GPP) string integrity (ad-tech-integrated sites) **Does not:** - Draft privacy policies — see `legalcode-privacy-policy-drafter` - Assess lawful bases for general data processing — see `legalcode-gdpr-legal-basis-assessment` - Conduct a full ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*