How to run a GDPR audit on your own website in an afternoon
You do not need a consultant for a first-pass GDPR audit. Here is the exact sequence, the tools, and what a finding should look like.
A GDPR audit sounds like something you hire out. The first pass is not. Most of the findings that matter are visible from a browser with developer tools open, and the rest come from reading two documents. Here is how to run it in an afternoon and end up with something you can hand to a lawyer or a buyer.
Step 1: Inventory what actually loads
Open your storefront in a private window. Before touching the cookie banner, open the Network tab and filter by domain. Write down every third-party host you see. Then open Application → Cookies and record every cookie set.
Anything in that list that is not strictly necessary for the site to function is a finding. Common offenders: google-analytics.com, connect.facebook.net, analytics.tiktok.com, static.hotjar.com, static.klaviyo.com.
Step 2: Test the banner properly
- 1Load the page fresh and click nothing. Are trackers firing? That is a prior-consent violation.
- 2Click Reject. Reload. Are they firing now? That is a rejected-consent violation, and it is worse.
- 3Count the clicks to reject versus accept. If reject takes more, that is a dark-pattern finding.
- 4Find the link that reopens preferences. If there is none, withdrawal is not as easy as consent.
Step 3: Read your privacy policy against what you found
Take your tracker list from step one and search the policy for each vendor name. Every processor you found should be named or covered by a named category. If your policy says 'we use Google Analytics' but you are also running the Meta Pixel, the policy is inaccurate — which is itself a breach of the transparency principle.
Step 4: Check the checkout flow
- Is marketing opt-in separate from order completion?
- Are shipping, tax and any subscription renewal terms disclosed before payment?
- Is the refund and cancellation policy reachable without leaving checkout?
- For subscriptions, is cancellation described in plain language and easy to find?
Step 5: Write findings, not opinions
A useful finding has four parts: what was observed, where, which obligation it touches, and the fix. 'Cookie banner is bad' is not actionable. This is:
| Field | Example |
|---|---|
| Observed | connect.facebook.net/en_US/fbevents.js loaded on first page view |
| Where | https://example.com/ (homepage), before any banner interaction |
| Obligation | ePrivacy Art. 5(3) — prior consent for non-essential storage |
| Fix | Gate the pixel behind the consent state; load it only after the marketing category is accepted |
Step 6: Re-test and keep the evidence
Fix, then repeat step two. Save a dated export of the network log and cookie list. That dated evidence is the whole point of the exercise — it turns 'we think we are compliant' into 'here is the state of the site on this date'.
Sites change, though. A new app, a new theme, one marketing tag pasted into the header, and you are back where you started. Whatever you use, run it on a schedule rather than once a year.
See where your own store stands in 60 seconds.
mir-n loads your storefront in a real browser, records every tracker and cookie fired before consent, checks your required documents and runs WCAG tests — then hands you the fix for each finding.
Run a free auditFrequently asked
How long does a GDPR audit take?
A first-pass technical audit of a single storefront takes two to four hours. A full audit including processor contracts, retention schedules and staff processes takes days to weeks depending on the size of the business.
Can I audit GDPR compliance automatically?
The technical half yes — trackers, cookies, banner behaviour, policy presence and checkout disclosures can all be checked automatically. Contracts, retention decisions and lawful-basis judgements still need a human.
How often should I re-audit?
After every theme change, app install or marketing tag deployment, and otherwise monthly. Most regressions come from a new third-party script, not a policy change.