A site may transmit identifiers, page addresses, events or form details to outside providers—even without setting cookies. Its privacy banner might also offer choices that the tracking setup doesn't enforce.

What does the law require? European Union (EU) and United Kingdom (UK) rules require organisations to provide accurate information about relevant personal-data processing. Separate rules for accessing or storing information on visitors' devices may require consent unless an exception applies. In California, covered businesses have notice duties and applicable sale/sharing opt-out obligations.

A third-party request isn't automatically unlawful. Its legal significance depends on what information is sent, who receives it, why it is sent and which rules apply.

How can you check? Compare the privacy notice with the website's actual data flows. The notice should accurately explain what Personal Information is collected, why it's processed, who receives it and other applicable details. Inventory cookies and scripts, inspect requests, forms and server-side integrations, and test whether relevant privacy choices work. Where you find discrepancies, remove unnecessary transfers, fix controls or update disclosures as appropriate. Repeat the review when the website changes.

Privacy Notice, Cookie Policy And Consent Banner: How They Fit Together

Four elements need to align:

• Privacy notice: Explains how you use Personal Information, including purposes, recipients, retention and rights.
• Cookie Policy: Covers cookies and related technologies.
• Consent banner or privacy-choice interface: Explains the available choices and should ensure they take effect.
• Live website: Shows what actually happens.

These elements don't replace one another. A cookie policy might list an analytics cookie but miss a form submission sent to another provider. Updating either document won't change a script's behaviour.

What Data Does Your Website Actually Share?

When someone views a product online, their browser contacts the shop's server and may also contact analytics, advertising, or chat providers. Depending on the setup, those requests could reveal an IP address, page URL, device information, a browser identifier, or a product-view event.

A payment provider may later receive checkout details. The notice should explain these different purposes, not group them under “improving your experience”.

Don't stop at a cookie list. Tracking can also involve local storage, pixels, tracking links, or information embedded in page URLs. A form may send an email address to a mailing-list provider; a video embed or social widget may contact another company as soon as it loads.

Other transfers use application programming interfaces (APIs), sometimes from your server rather than the visitor's browser.

Browser logs can miss transfers between servers, while cookie scans don't always reveal how collected information is used.

Which Third-Party Tools And Trackers Are Easy To Miss?

Third-party services and marketing tools often arrive through tag managers, plugins or supplier integrations without prompting a privacy-notice review.

An agency might add an advertising pixel through Google Tag Manager without changing the website's main code—or prompting a check of the new recipient, purpose and privacy notice.

Check what each analytics service receives: page views, purchase events or account events. For chat providers, establish whether they follow the website operator's instructions or use information independently. Identify the company behind each receiving domain.

A provider acting only on your instructions isn't necessarily in the same legal position as an advertising platform deciding how to use the data. A scanner can't establish those roles. Review the configuration, supplier terms and how the service operates.

Why Privacy Notices Become Outdated

In some organisations, marketing manages advertising tags, developers handle integrations and the privacy team owns the legal copy. Without coordination, website changes can go live without prompting a review of the privacy notice.

Add this question to release checks:

Will this change affect what we collect, send, share or let visitors control?

If yes, involve the notice's owner.

The UK's Information Commissioner's Office (ICO) advises organisations to review privacy information regularly. For a new purpose, its updated guidance says to update the privacy information and tell people before reusing their data. Check purpose compatibility and the lawful basis too.

Does Your Cookie Consent Banner Respect Visitor Choices?

A visitor rejects advertising tracking, and the banner saves the preference. Yet the tag might still send page views, or stop setting a cookie while sending an identifier. Withdrawal may leave the script active. A browser opt-out might not reach a server-side advertising event.

Not every remaining request indicates a failure. Some provide a service, communicate a privacy signal or meet a legal exception. A browser may still request a blocked script's file. Check what the request sends, whether code runs and whether tracking continues. Blocking future tracking doesn't erase data already collected.

Test tracking behaviour:

• Before a visitor makes a choice, using a fresh session.
• After accepting or rejecting tracking.
• After changing preferences or withdrawing consent.
• After reloading the page or starting another fresh session.

Repeat the tests on forms, videos and checkout. Where applicable, also test browser signals such as Global Privacy Control (GPC). Under California law, GPC communicates a sale/sharing opt-out rather than a blanket rejection of cookies.

How Personal And Sensitive Information Reaches Third Parties

A booking event might include the appointment type. A URL could reveal a sensitive search; a form might pass along an email address or financial details. Session-recording tools may capture unmasked form entries.

Look inside request parameters and payloads, especially around accounts, checkout and sensitive forms. Don't assume a label such as conversion tells you everything the request contains.

In the United States (US), the Federal Trade Commission (FTC) finalised an order involving BetterHelp in 2023. The FTC alleged that the online counselling company disclosed information including email addresses, IP addresses and answers to health questions to advertising platforms despite promises about privacy. The final order restricted specified disclosures and required a $7.8 million payment to fund consumer refunds.

How EU, UK And California Privacy Laws Differ

“Consent”, “opt-out”, “sale” and “sharing” have distinct legal meanings that vary by jurisdiction.

The EU's eprivacy Directive rules extend beyond cookies. In its October 2024 guidance on Article 5(3) of the Directive, the European Data Protection Board (EDPB) clarified that device-access rules may also cover tracking pixels and tracking links, depending on how they operate.

The UK's statistical-purpose exception under the Privacy and Electronic Communications Regulations (PECR) covers statistics used to improve a service, not individual tracking or profiling. According to the Information Commissioner's Office (ICO) guidance, individual-level information must not be retained longer than needed for aggregation.

Third-party analytics providers relying on this exception must act as processors, not joint controllers. They may use the information only for the permitted purpose and must not combine it with other data they handle. Where personal data is processed, the UK General Data Protection Regulation (UK GDPR) still applies. The exception does not provide blanket exemptions for advertising or all analytics services.

In California, regulations adopted by the California Privacy Protection Agency (CPPA) under the California Consumer Privacy Act (CCPA) generally require risk assessments before new qualifying processing begins. Qualifying processing activities that began before 1 January 2026 and continue afterward must be assessed by 31 December 2027. The first submission of required risk-assessment information, including a summary and attestation for 2026 and 2027, is due by 1 April 2028.

The California Attorney General's guidance explains CCPA rights. Other US states have their own definitions and requirements.

How To Audit Your Privacy Notice Against Website Data Flows

Begin with your homepage, busiest landing pages, product pages, forms and checkout. Include relevant mobile or regional variations and use test accounts.

1. See what's running. Inventory cookies, scripts, pixels, tag-manager rules, embedded services and browser storage. Watch network requests during realistic visits, not just the first page load.
2. Identify recipients. Connect domains to organisations. Include form destinations, payment integrations, redirects and server-side transfers.
3. Check what is sent and why. Look at identifiers, URLs, event details and form fields. Ask the tool owner what the information is used for.
4. Compare the wording. Can readers understand the processing from the notice, cookie information and explanations beside forms? Check that applicable purposes, recipients and choices are covered.
5. Document control behaviour. For each relevant privacy choice, save evidence of which scripts run, which identifiers appear and where information goes. Repeat after reloading; note differences between regions or sessions.
6. Check sensitive data at field level. Use test values to see whether form entries, account identifiers, search terms or other sensitive information appear unexpectedly in URLs, event properties or third-party requests.
7. Record the mismatches. Note tags or fields that seem unnecessary, failed blocking or opt-outs, supplier questions and incomplete disclosures. Assign an owner and proposed action to each finding.
8. Verify fixes and schedule rechecks. Retest affected journeys and keep the results. Review again when tags, vendors, forms or consent settings change.

An initial inventory for an advertising pixel could look like this:

Scans may miss login-only features and regional tags. Document these limitations; a clean scan isn't a compliance certificate or a substitute for a legally required risk assessment.

What To Fix When Your Privacy Notice Doesn't Match Your Website

If an enquiry form sends a customer's message to an advertising tool, adding a disclosure may not be the right fix. If the transfer is unnecessary or impermissible, remove or restrict it.

When a privacy control fails, find the cause: a browser script, Google Tag Manager trigger, server-side integration or vendor configuration. Fix it, then retest the affected activity.

If the processing is legitimate but the explanation is incomplete, update the notice and related cookie or collection-point wording. Review supplier roles, retention and international transfers as needed.

Assign owners: marketing explains purposes, developers test requests, procurement checks contracts and privacy teams assess legal duties.

How A Consent Management Platform Supports Privacy Audits

A consent management platform (CMP) can support privacy-notice audits by identifying technologies, recording privacy choices and helping scripts respond to those choices.

Features directly relevant to a privacy-notice audit include:

• Cookie scanning: helps inventory cookies and related technologies, for example using an online scanner.
• Automated recurring scans: help detect changes after new tags or integrations go live.
• Consent recording: preserves visitors' choices for later review.
• Automatic script blocking: helps prevent consent-dependent scripts from running without the necessary permission.
• Privacy policy generation: helps draft privacy notices that still need to be checked against actual processing.
• Cookie policy generation: helps maintain cookie-related documentation alongside the wider privacy notice.
• Google Tag Manager integration: helps connect consent choices with tag behaviour. GTM tags need appropriate triggers or consent settings; automatic script blocking alone may not control tags fired through GTM.

CMPs may also offer additional privacy-management features, such as:

• Consent events
• Geo targeting
• Global privacy regulation support
• Multilingual support
• Google Consent Mode v2 (Basic vs Advanced; Google documentation)
• Advanced reporting
• Cookie Banner sharing
• IAB TCF 2.4 integration

CookieScript is a CMP that Google includes among its partners available for Consent Mode setup. It is also a Google-certified CMP and received Gold tier status in Google's CMP tiering system.

A 14-day free trial of the Plus plan is available without requiring a credit card.