Most GDPR compliance guides read like they were written by a lawyer billing by the paragraph. This one is different. We have spent the last two years watching real websites fail audits, get flagged by data protection authorities, and lose ad tracking because of consent misconfigurations. What follows is the actual checklist we use internally when onboarding a new site to Consentio. Seven steps, in order, no fluff.

Before you start: why order matters

People tend to jump straight to slapping a cookie banner on their site and calling it a day. That is backwards. A banner without a proper cookie audit behind it is theatre. You are telling visitors "we respect your choices" while having no idea what scripts are actually firing. So we start with the audit.

Step 1: Run a full cookie audit

You cannot write an accurate cookie policy or configure your banner categories if you do not know what cookies your site sets. Every cookie, every tracker, every pixel. First-party and third-party.

What you are looking for:

  • All cookies set by your own code (session tokens, language preferences, shopping carts)
  • Cookies dropped by third-party scripts (Google Analytics, Meta Pixel, Hotjar, chat widgets, embedded videos)
  • Local storage and session storage entries that function as trackers
  • Server-side cookies set via HTTP headers that visitors never see in the browser console

Doing this manually means opening DevTools, clicking through every page, clearing cookies between page loads, and hoping you did not miss anything. Or you can use an automatic cookie scanner that crawls your site and maps everything in minutes. We wrote a longer guide on how to do a thorough cookies audit if you want the full walkthrough.

Either way, the output should be a spreadsheet (or a structured list in your consent platform) with each cookie's name, domain, purpose, category, and expiration. This becomes the source of truth for everything else.

Step 2: Classify cookies into the right categories

GDPR does not actually mention "cookie categories" anywhere in the text. But the European Data Protection Board (EDPB) guidelines and the ePrivacy Directive have settled on a standard classification that regulators expect:

  • Strictly necessary: cookies without which the site literally cannot function. Login session tokens, CSRF protection, load balancer cookies, shopping cart state. These do not require consent.
  • Functional / Preferences: language settings, region selection, UI customisation. They make the site work better but the site can function without them.
  • Analytics / Statistics: Google Analytics, Matomo, Hotjar recordings, A/B testing tools. They track behaviour but do not serve ads.
  • Marketing / Advertising: Meta Pixel, Google Ads remarketing, LinkedIn Insight Tag, any cookie used to build an advertising profile or serve targeted ads.

The mistake people make most often: putting analytics cookies in the "necessary" category. Google Analytics is not necessary for your site to work. Neither is Hotjar. Regulators have been clear about this since at least 2019, yet we still see sites doing it. If you need a refresher on what counts as what, our GDPR guide breaks it down in detail.

Step 3: Set up a proper cookie consent banner

This is where most people start, and where most mistakes happen. A GDPR-compliant cookie banner needs to meet several requirements that are easy to get wrong:

  • Consent must be opt-in. No pre-ticked checkboxes, no "by continuing to browse you accept" nonsense. The visitor must actively click something to give consent.
  • "Reject all" must be as easy to find as "Accept all." The CNIL (France), AEPD (Spain), and Austrian DPA have all fined companies for burying the reject option behind multiple clicks. If accepting takes one click and rejecting takes three, that is a dark pattern and regulators will treat it as one.
  • No scripts in the analytics or marketing categories should fire before the visitor has given consent. This sounds obvious but is the single most common failure mode. Tags load on page load, fire before the consent check runs, and drop cookies. By the time the banner appears, the damage is done.
  • Visitors must be able to withdraw consent just as easily as they gave it. A "manage cookies" link in the footer that re-opens the preference panel is the standard approach.
  • If your site serves visitors in multiple languages, the banner needs to appear in their language. A Czech visitor reading a Czech page should not get an English consent dialog. See multilingual cookie banner for how this works in practice.

If you are building a banner from scratch, you will spend weeks on edge cases. Most teams are better off using a consent management platform (CMP) that handles all of this out of the box. Our visual banner editor lets you configure layout, colours, and copy without writing code, and it handles the script-blocking logic automatically.

We have a whole article on cookie banner best practices if you want to go deeper on design and copy that gets consent rates up without crossing legal lines.

Step 4: Create and publish a cookie policy

Your cookie banner tells visitors what categories exist and lets them choose. Your cookie policy is the detailed document that lists every cookie by name, explains what it does, who sets it, and how long it lasts. GDPR Article 13 requires this level of transparency.

A good cookie policy includes:

  • A table or list of every cookie with its name, provider, purpose, category, type (HTTP, local storage, session), and expiration
  • An explanation of what each category means
  • How visitors can change or withdraw their consent
  • Contact details of the data controller and, if applicable, the DPO
  • The date the policy was last updated

The policy must stay up to date. Every time you add a new analytics tool or marketing pixel, the policy needs updating. This is tedious if you maintain it manually, which is why we built a cookie policy generator that creates the page automatically from your scan results and keeps it in sync when cookies change.

Step 5: Implement Google Consent Mode v2

If your site uses any Google service (Analytics, Ads, Tag Manager, or even YouTube embeds), you need Google Consent Mode v2. Since March 2024, Google requires websites in the EEA to send consent signals via Consent Mode. Without it, your Google Ads remarketing audiences stop working and your Analytics data develops gaps.

Consent Mode works by sending two consent states to Google tags:

  • analytics_storage: controls whether Google Analytics can set cookies
  • ad_storage: controls whether Google Ads can set cookies for remarketing
  • ad_user_data: controls whether user data can be sent to Google for advertising
  • ad_personalization: controls whether personalised ads can be shown

When a visitor rejects cookies, Consent Mode tells Google tags to run in "cookieless" mode. Google then uses modelling to fill in some of the data gaps. You lose precision but you keep some signal, which is better than getting nothing.

Setting this up manually means editing your GTM container, adding consent-default and consent-update commands, and testing across multiple scenarios. Or you pick a CMP that handles it automatically. Consentio fires the correct Google Consent Mode v2 signals out of the box, with no GTM configuration needed. We wrote a complete implementation guide if you want the technical details.

Step 6: Record and store consent proof

Article 7(1) of GDPR says: "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented." In practice, this means you need logs.

Every consent event should record:

  • A timestamp of when consent was given or withdrawn
  • Which version of the cookie policy was active at that time
  • What categories the visitor accepted and rejected
  • A unique consent ID that can be looked up later

If a DPA audits you, they will ask to see these records. "We had a banner" is not enough. You need the receipts. Most serious CMPs store consent records server-side with retention policies that match GDPR requirements.

Step 7: Monitor, measure, iterate

Compliance is not a one-time project. Your site changes, new scripts get added by marketing teams, third-party tools update their cookies, and regulations evolve. Here is what ongoing maintenance looks like:

  • Re-scan regularly. Run your cookie scanner at least once a month, or after any deployment that adds third-party scripts. New cookies from updated SDKs or freshly embedded widgets will slip through if you do not check.
  • Watch your consent rate. If fewer than 40-50% of visitors accept analytics cookies, something about your banner copy, timing, or design is putting people off. Consent analytics give you the numbers to diagnose what is happening: opt-in rates by category, by page, by device, by country.
  • Keep your cookie policy current. Every scan that finds new cookies should trigger a policy update. Stale policies are a compliance gap regulators notice.
  • Follow regulatory changes. The ePrivacy Regulation, when it finally arrives, will tighten cookie rules further. DPA enforcement is also getting more aggressive year over year. Keep an eye on rulings in your market.

Common mistakes we see every week

After onboarding hundreds of websites, certain patterns repeat:

  1. Cookie wall without a reject option. "Accept cookies to continue" violates GDPR unless you offer an equivalent cookie-free version of the site. Very few sites can justify this.
  2. Banner appears but scripts already fired. The most common technical failure. Tags load synchronously before the CMP initialises. Check your network tab after a hard refresh with cookies cleared: if you see GA or Meta requests before the banner appears, you have a problem.
  3. Consent carries over to a different domain. If you run multiple domains, consent on domain A does not cover domain B. Each domain needs its own consent flow.
  4. "Legitimate interest" for marketing cookies. Some sites try to process advertising data under legitimate interest instead of consent. The EDPB has been clear that tracking for advertising almost always requires explicit consent. Do not try this.
  5. No way to withdraw consent. The banner appeared once, the visitor accepted, and now there is no link or button anywhere on the site to change that decision. This fails GDPR Article 7(3).

Platform-specific notes

The checklist above applies everywhere, but some platforms have quirks worth knowing:

  • WordPress: plugins like WooCommerce, Elementor, and various form builders each add their own cookies. A WordPress cookie plugin that integrates at the theme level can catch these automatically.
  • E-commerce (Shopify, WooCommerce, Shoptet): payment processors, review widgets, and remarketing pixels stack up fast. E-commerce cookie compliance has its own set of considerations around transaction-essential cookies vs. marketing cookies.
  • Single-page applications: SPAs that load via client-side routing can break consent checks if the CMP only runs on initial page load. Make sure consent state is checked on route change, not just on DOMContentLoaded.

The short version

If you take nothing else away, here is the checklist in seven lines:

  1. Audit every cookie on your site
  2. Classify them into the four standard categories
  3. Set up a consent banner that blocks scripts until opt-in
  4. Publish a detailed, up-to-date cookie policy
  5. Implement Google Consent Mode v2 if you use any Google tools
  6. Log consent events with timestamps and category choices
  7. Re-scan monthly, watch your consent rate, update as things change

That is it. No mystery, just work that needs doing.

If you want to get through this list fast, Consentio's free plan covers the scanner, the banner, consent logging, and Consent Mode v2 out of the box. Takes about five minutes to set up. The cookie banner generator walks you through the whole process.