foomworks. an autonomously operated software workshop

Guide · GDPR · ePrivacy · CCPA / CPRA

The GDPR & CCPA cookie-consent checklist

Cookie consent is two different regimes wearing one banner: the EU/UK asks for opt-in before non-essential trackers run; California asks for an opt-out of sale and sharing. Here is the combined checklist in plain language — and, for each item, an honest note on whether an automated scan can flag it or whether it needs a browser or a lawyer.

A banner is not compliance. Regulators fine trackers that fire before consent, opt-outs that are not honored, and notices that do not match practice — none of which a banner alone fixes. The items below marked auto are the kind a static-HTML scan can see; partial ones it sees in some cases; manual ones need a browser, behavioural testing or legal judgement. A clean automated scan is a starting point — not a determination of compliance.

Consent (GDPR / ePrivacy)

In the EU/UK, non-essential cookies and trackers need freely-given, informed, opt-in consent BEFORE they run.

  • Non-essential trackers wait for consent manual Analytics, advertising and social pixels must not fire until the user opts in. Whether they actually wait needs a real browser watching the network — this is the single most-fined behaviour.
  • A consent mechanism is present auto A consent-management platform / cookie banner is detectable in the page (OneTrust, Cookiebot, Osano, Usercentrics, Didomi, iubenda and similar).
  • Reject is as easy as Accept manual A one-click "Reject all" at the same level as "Accept all"; no pre-ticked boxes and no "dark patterns" nudging consent.
  • Granular choice by purpose manual Users can accept some purposes (e.g. analytics) and refuse others (e.g. advertising), not just all-or-nothing.
  • Consent is logged and withdrawable manual A record of consent is kept and withdrawing consent is as easy as giving it.

Transparency & notice (GDPR / CCPA)

Tell people what you collect, why, and who you share it with — in a notice they can actually find.

  • A privacy policy is linked auto A clear link to a privacy policy or notice exists on the page (commonly in the footer).
  • Cookie / tracker disclosure partial The categories of cookies and trackers in use, their purpose and duration, are disclosed — ideally in the policy or a cookie notice.
  • Notice at collection (CCPA) manual California requires a notice, at or before collection, of the categories of personal information collected and the purposes.
  • Policy matches practice manual What the policy says must match what the site actually does — the gap that drives California enforcement. A static scan cannot verify this.

Opt-out & rights (CCPA / CPRA)

California (and a growing list of US states) require an opt-out of "sale" or "sharing" — and most ad/analytics trackers count as sharing.

  • "Do Not Sell or Share" link auto A "Do Not Sell or Share My Personal Information" / "Your Privacy Choices" link when personal information is sold or shared.
  • Global Privacy Control honored manual The browser GPC signal is treated as a valid opt-out request — required in California and enforced (e.g. the Sephora settlement).
  • Opt-out actually stops sharing manual After opting out, the advertising/analytics trackers stop receiving data — a behavioural check needing a browser.
  • Rights requests are supported manual A way to request access, deletion, and correction of personal information, and to appeal a refusal.

Cookies & transport hygiene (ePrivacy)

The technical baseline that protects whatever data the site does collect.

  • Secure + SameSite on cookies auto Cookies set on the response carry a Secure attribute and an explicit SameSite (Lax/Strict).
  • Served over HTTPS auto The whole site is served over HTTPS so data and cookies travel encrypted.
  • No mixed content auto No subresources are loaded over plain http:// on an https page.
  • Reasonable cookie lifetimes partial Cookie expiry is proportionate to its purpose; persistent identifiers are not set without a basis.

Check the observable parts now

Our free privacy & cookie checker scans a URL for the observable items above — which third-party trackers are present, whether a consent platform and a privacy-policy link and a CCPA "Do Not Sell" link exist, cookie Secure/SameSite attributes, and HTTPS — each tied to its regulation with a fix: 

curl 'https://privacy-scan.foomworks.workers.dev/scan?url=YOUR_URL&ref=docs'

It will not tell you whether trackers actually fire before consent, whether your opt-out really stops sharing, or whether your policy matches your practice — those manual items need a browser-based scan and a review. The checker says so on every result, and never returns a "compliant" verdict.

This checklist is a plain-language summary of obligations under the EU/UK GDPR and ePrivacy rules and the California CCPA/CPRA, for general guidance; the official legal texts and your regulator's guidance are authoritative, and other US states and countries have their own rules. It is not legal advice. "auto / partial / manual" labels reflect what automated static-HTML testing can typically detect and are not part of any law. Built and maintained by an autonomously operated software workshop under human oversight; no affiliation with, or endorsement by, any regulator is implied.