Choosing a consent tool is easier when you know what the website actually does. A small brochure site can accumulate analytics tags, advertising pixels, embedded videos, chat widgets and form integrations over several years. The person choosing the next banner may know about only some of them.
A tracking audit creates a usable picture of those technologies, their purposes and their behaviour. It also reveals tools the business no longer needs. This gives you a clearer brief for implementation and a way to check a supplier's claims against your own website.
The audit should produce evidence, decisions and an assigned action list. A screenshot of a banner or a scanner's list of cookie names is a starting point, but neither establishes that visitor choices control every relevant technology correctly.
Start with the business functions and their owners
List the jobs the website supports: enquiries, bookings, audience measurement, campaign reporting, video playback and any account features. Ask who owns each job and which systems help perform it. This brings marketing, website administration and operational colleagues into the same conversation.
Trace the implementation route for each tool. A tag may be inserted through a tag manager, a plugin, a page template or an embedded service. Knowing the route matters because a consent tool connected to one tag manager cannot automatically control a separate script inserted elsewhere.
Record whether the business still uses the output. An old advertising account may continue receiving data after the campaign ended, or two analytics implementations may measure the same events differently. Give the owner a specific question to answer instead of assuming every installed tool remains necessary.
Set a clear audit boundary. Include the public website and its main customer journeys, then identify external booking or payment destinations that require separate inspection. State which domains and systems were reviewed, so the final report does not imply broader coverage than the work supports.
Observe several realistic visitor states
Inspect the site as a new visitor with a clean browser state, then follow important tasks. Note which technologies appear before any choice and which appear after interaction. A tool may load only when someone opens a video, uses a form or visits a campaign page.
Compare meaningful states such as no choice, rejection, acceptance, a selected category and withdrawal. Record the steps taken and the resulting behaviour. This makes a finding reproducible and helps distinguish an implementation fault from a test performed with old preferences still stored.
Use browser inspection alongside the site's configuration and available supplier documentation. Observe storage and network activity, but avoid assuming that every request stores information or that every tracker uses a traditional cookie. A technical reviewer should explain what the evidence establishes and what remains uncertain.
Storage and access rules cover more than cookies and include specific exceptions as well as consent requirements. Classify actual purposes against current ICO guidance. A supplier's default category or a tool's name does not settle the assessment. Our website privacy and technology review guide provides the related checks.
Create an inventory that supports decisions
Use a short record for each technology or connected function. Include the owner, implementation location, observed trigger, relevant supplier, intended purpose and evidence link. Add questions where information is incomplete rather than quietly filling gaps with a scanner's guess.
Distinguish a technology from its uses. One service can support several purposes, and a business may have configured a feature differently from the supplier's default. Ask the owner which features are enabled and verify the actual configuration where possible.
Keep findings understandable for the people making the decision. A raw network log is useful technical evidence, but the action owner also needs a plain explanation. “The advertising tag loads before the visitor has made a choice” is a clearer issue statement than a list of unexplained request URLs.
Assign a confidence level and a next step to uncertain findings. A third-party request might require supplier clarification or additional testing. The report should show the uncertainty and identify who will resolve it, rather than presenting every observation as an equally certain conclusion.
Work through one journey in detail
Imagine a service page with an embedded video, an enquiry form and advertising measurement. A visitor rejects optional tracking, watches the video and submits an enquiry. The audit needs to establish which features remain usable and what happens at each step.
The video might require an alternative presentation until an appropriate choice is made. The form may still need to perform its core task without advertising measurement. Document the intended experience, then inspect whether the implementation behaves that way in a fresh session.
Check that the business receives the enquiry and that the confirmation is accurate. A consent change that accidentally disables submission can create an operational failure. Conversely, successful submission does not prove the advertising technology respected the visitor's choice.
Use the resulting evidence to brief the implementation team. Specify the trigger, expected state and test outcome for each connected feature. This is much more actionable than asking a supplier to “make the site compliant” without describing its actual functions.
Compare consent tools against your requirements
Ask how the proposed tool controls your installation routes and handles technologies that load after user interaction. Request a demonstration using a representative journey, not only the supplier's standard demo page. The connection between the banner and the scripts needs to be visible.
Check whether categories, explanations and supplier details can be maintained by the right people. A tool that requires specialist intervention for every minor content change may be unsuitable for a frequently updated website. Equally, unrestricted editing can lead to accidental changes in important behaviour.
Review preference management on mobile and with a keyboard. Visitors should be able to understand the options and return to their settings. Ask the implementation team to demonstrate how a changed preference affects subsequent behaviour, rather than approving the appearance of a settings link alone.
Compare the ongoing cost and work. Include scans, configuration, supplier updates, testing, support and any limits on domains or traffic. A low subscription price may still require substantial maintenance, while a larger package may include capabilities your website does not need.
Turn the audit into a controlled implementation
Separate removals, configuration changes, explanation updates and unresolved classification questions. Give each action an owner and verification method. Remove obsolete tools through a controlled change, so the business understands any effect on reporting or customer features.
Agree the classification and implementation decisions with the people responsible for privacy and the relevant business functions. Record the reasoning and the supporting evidence. The tool implements those decisions; buying it does not replace the need to make them.
Test the agreed visitor states after installation using the same important journeys. Retain evidence of the configuration and results, including limitations that need further work. A successful audit should make the next review easier to repeat.
Keep the privacy information connected to the actual installation. When the business changes a tool or its purpose, update the relevant explanation and review the behaviour. A maintained inventory helps prevent the website and its notices from drifting apart.
Keep tracking changes visible after launch
Add a tracking check to the process for introducing new plugins, embeds and campaigns. Ask what the new feature does, how it is controlled and who maintains it. This catches changes near their source instead of discovering them during an annual review.
Review after meaningful website changes and according to the site's operating needs. Preserve a small set of repeatable tests for the most important journeys. Automation can assist observation, but somebody still needs to interpret unexpected results.
Giraffe Digital's website design service connects content, structure and customer journeys. A tracking audit makes privacy implementation part of that practical design work, with clear ownership and evidence that the chosen controls behave as intended.
Frequently asked questions
How should we start with the business functions and their owners?
List the jobs the website supports: enquiries, bookings, audience measurement, campaign reporting, video playback and any account features. Ask who owns each job and which systems help perform it. This brings marketing, website administration and operational colleagues into the same conversation. Trace the implementation route for each tool. A tag may be inserted through a tag manager, a plugin, a page template or an embedded service. Knowing the route matters because a consent tool connected to one tag manager cannot automatically control a separate script inserted elsewhere. Record whether the business still uses the output. An old advertising account may continue receiving data after the campaign ended, or two analytics implementations may measure the same events differently.
How should we create an inventory that supports decisions?
Use a short record for each technology or connected function. Include the owner, implementation location, observed trigger, relevant supplier, intended purpose and evidence link. Add questions where information is incomplete rather than quietly filling gaps with a scanner's guess. Distinguish a technology from its uses. One service can support several purposes, and a business may have configured a feature differently from the supplier's default. Ask the owner which features are enabled and verify the actual configuration where possible. Keep findings understandable for the people making the decision. A raw network log is useful technical evidence, but the action owner also needs a plain explanation. "The advertising tag loads before the visitor has made a choice" is a clearer issue statement than a list of unexplained request URLs.
How should we work through one journey in detail?
Imagine a service page with an embedded video, an enquiry form and advertising measurement. A visitor rejects optional tracking, watches the video and submits an enquiry. The audit needs to establish which features remain usable and what happens at each step. The video might require an alternative presentation until an appropriate choice is made. The form may still need to perform its core task without advertising measurement. Document the intended experience, then inspect whether the implementation behaves that way in a fresh session. Check that the business receives the enquiry and that the confirmation is accurate. A consent change that accidentally disables submission can create an operational failure. Conversely, successful submission does not prove the advertising technology respected the visitor's choice.
How should we compare consent tools against our requirements?
Ask how the proposed tool controls your installation routes and handles technologies that load after user interaction. Request a demonstration using a representative journey, not only the supplier's standard demo page. The connection between the banner and the scripts needs to be visible. Check whether categories, explanations and supplier details can be maintained by the right people. A tool that requires specialist intervention for every minor content change may be unsuitable for a frequently updated website. Equally, unrestricted editing can lead to accidental changes in important behaviour. Review preference management on mobile and with a keyboard. Visitors should be able to understand the options and return to their settings. Ask the implementation team to demonstrate how a changed preference affects subsequent behaviour, rather than approving the appearance of a settings link alone.
How should we keep tracking changes visible after launch?
Add a tracking check to the process for introducing new plugins, embeds and campaigns. Ask what the new feature does, how it is controlled and who maintains it. This catches changes near their source instead of discovering them during an annual review. Review after meaningful website changes and according to the site's operating needs. Preserve a small set of repeatable tests for the most important journeys. Automation can assist observation, but somebody still needs to interpret unexpected results. Giraffe Digital's website design service connects content, structure and customer journeys. A tracking audit makes privacy implementation part of that practical design work, with clear ownership and evidence that the chosen controls behave as intended.
