The 2026 Website Cookie & Privacy Audit Checklist
A rigorous, step-by-step 12-point audit checklist for evaluating business websites before launch or client handover.
Zero Non-Essential Cookies on Initial Page Load
Open Chrome DevTools $\rightarrow$ Application $\rightarrow$ Cookies on an incognito window. Prior to clicking any banner button, no tracking or analytics cookies (e.g., _ga, _fbp, _clck) should exist.
Equal Prominence for Accept and Reject Buttons
Under EDPB guidelines, the 'Reject All' button must have equal visual prominence, color contrast, and font size as the 'Accept All' button. Deceptive dark patterns are fined heavily.
Local Self-Hosting for Web Fonts
Audit CSS and network traces to confirm fonts are served locally from your origin domain (e.g., /assets/fonts/) rather than dynamically streaming from Google or Adobe servers.
Secure, HttpOnly, and SameSite Flags on Session Cookies
Ensure all functional session cookies specify SameSite=Lax (or Strict) and Secure to mitigate Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF).
Run an Automated Scan
Check all 12 checkpoints in under 10 seconds with PrivacyLens Pro.
Launch Automated Scanner