GDPR Tracking Compliance Audit
Technical audit of how your tracking stack responds to user consent choices. We intercept network requests across all consent states and document exactly which tags fire before they should, which consent signals are missing or misconfigured, and whether Consent Mode v2 is correctly integrated with your CMP.
Network-interception audit of your tracking stack across all four consent states, producing a violations report with specific remediation steps.
Any business with EU users who has a cookie banner but has never verified whether tags actually stop firing when they should.
- 12-15 hours across one primary domain
- All four consent states tested via network interception
- Every third-party request documented
- Works with any CMP
Depending on your existing setup, some steps below can be shortened or skipped entirely.
Delivery roadmapHow we deliver GDPR Tracking Compliance Audit.
Setup and scoping
We document all domains and user journeys in scope and confirm access to your tag manager and CMP before any testing begins.
Network interception across consent states
We intercept every outbound network request across four states: no interaction, rejected, partial, and accepted, capturing timing and payloads for each.
Consent signal verification
We confirm that Consent Mode v2 signals reach Google tags correctly and that your CMP callback fires before tags initialise on the page.
Remediation plan
Each violation is documented with receives a specific fix. Where possible we validate the fix in a staging environment before signing off.
Overview
How to know if you need a GDPR Tracking Compliance Audit
- You have a cookie banner but have never confirmed via network testing that tags actually stop firing when users decline or ignore it.
- A GDPR review, legal team, or data protection officer has flagged your tracking setup as a potential compliance risk.
- You use multiple analytics and advertising tags and are not sure all of them respect consent signals correctly.
- You have recently changed your CMP, tag manager setup, or consent configuration and have not re-tested since.
What the GDPR Tracking Compliance Audit covers
- Network interception across four consent states: no interaction, rejected, partial consent, and accepted.
- Every outbound network request documented relative compliance status.
- Consent Mode v2 signal verification: correct parameters reaching Google tags, and callback firing before tag initialisation.
- CMP integration review: whether your CMP's consent signal is correctly wired to your tag manager.
- Specific identification of which tags fire before they should and the precise timing of each pre-consent request.
GDPR Tracking Compliance Audit outcomes
- A violations report listing every pre-consent data request with screenshots, timing, and the specific tag responsible.
- A technical remediation plan with a specific fix for each violation.
- Evidence of compliance for each consent state, which can be retained for documentation purposes.
GDPR Tracking Compliance Audit scope and hours
- 12-15 hours across one primary domain.
- Works with any CMP: Cookiebot, OneTrust, Usercentrics, CookieYes, and others.
- Scope confirmed after reviewing the number of domains, subdomains, tag stack, and CMP setup.
What makes our GDPR Tracking Compliance Audit different
- We test actual network traffic, not just the GTM configuration. A tag can look correctly configured and still fire pre-consent due to timing issues.
- Every violation is documented and gets a specific fix, not a general recommendation to 'review your consent setup'.
- This is a technical compliance review of your tracking layer, not a general legal assessment. We audit what the tags actually do.
More GDPR services
View all GDPR servicesWant to try before you commit?
- Looking to try out Beluacode but not sure about it? You can always ask us for a free audit.
- Free, no strings attached. We deliver the results and wish you a great day.
- You will not be forced to talk to us, no call needed to release the results :)
Frequently Asked Questions
Is having a cookie banner enough for GDPR compliance?
What is network interception testing in a GDPR compliance audit?
What does 'four consent states' mean in a GDPR tracking audit?
Do you fix the violations found during the GDPR audit?
Does the GDPR Tracking Compliance Audit cover Consent Mode v2?
Pairs well with
Usercentrics Banner Implementation
Full Usercentrics deployment: banner configuration, GTM or direct integration, Consent Mode v2 wiring, and four-state validation. Covers both the UI layer and the underlying consent signal flow.
CookieYes Banner Implementation
CookieYes deployment with GTM integration, Consent Mode v2 configuration, and full four-state compliance testing. Suitable for businesses on any CookieYes plan.
Cookiebot Banner Implementation
Cookiebot deployment with GTM integration, Consent Mode v2 setup, and network-level compliance verification across all four consent states.
Request a Quote
Review your selected services and submit your quote request.
We'll get in touch within 24 business hours.
