You can't fix what you don't measure. When the California Privacy Protection Agency conducts an audit on your sector, or when a consumer complaint reaches a state Attorney General, the investigation begins with a simple step: someone visits your website to check if it operates as your privacy policy claims.
Most enforcement actions this year shared a common thread. Companies fined weren't ignoring compliance; they thought they were compliant. Their policies seemed fine, and their Consent Management Platforms (CMPs) displayed banners correctly. But the backend told a different story. That gap between appearance and function is what regulators are testing for.
Here's a checklist you can run yourself, focused on the seven areas regulators are actively enforcing.
Purpose of This Checklist
This is a technical compliance audit template, not a policy review. It's designed to identify the gap between what your site claims to do and what it actually does when a user exercises their rights. Run this quarterly, after any CMP configuration change, and before any regulatory inquiry.
You're looking for functional failures that policies can't fix: opt-outs that don't stop tracking, Global Privacy Control (GPC) signals your site ignores, dark patterns in your consent flow, vendor contracts that don't match your stated purposes, missing age-assurance gates, stale privacy notices, and subject rights request workflows that time out or return incomplete data.
Prerequisites
Before you start:
- Admin access to your CMP and the ability to view which tags fire in different consent states.
- A browser extension or dev tools setup that lets you inspect network requests, cookies, and storage APIs (Local Storage, IndexedDB, Session Storage).
- A test GPC-enabled browser (Firefox with the GPC extension, or Brave with GPC turned on in settings).
- Access to your vendor contracts or at least a list of third-party processors and what data they're allowed to use.
- A copy of your current privacy policy and the date it was last substantively updated.
- The ability to submit a test subject rights request through your own intake form.
If you don't have direct access to these, involve your CMP vendor, your legal team, and whoever manages your tag infrastructure. This isn't a one-person job.
The Audit Checklist
1. Opt-Out Mechanism Test
What you're checking: Does rejecting cookies actually stop tracking tags from firing?
How to test:
- Open your site in an incognito window with dev tools open (Network tab).
- Interact with your Consent Notice and reject all Non-Essential Cookies.
- Navigate to a second page on your site.
- Filter network requests for third-party domains (ad-tech vendors, analytics platforms, social widgets).
- Check Local Storage, Session Storage, and IndexedDB for identifiers.
Pass condition: Zero third-party tracking requests after rejection. No persistent identifiers written to browser storage.
Common failure: The banner updates visually, but Google Analytics, Facebook Pixel, or ad-tech tags keep firing. Healthline Media was fined $1.55 million because 118 tracking cookies fired after visitors used all three opt-out methods. Research shows 79% of websites keep firing tracking tags after a user opts out.
2. Universal Opt-Out Signal Compliance
What you're checking: Does your site honor Global Privacy Control signals?
How to test:
- Enable GPC in your browser (Brave's privacy settings or Firefox with the GPC extension).
- Visit your site with dev tools open.
- Check whether your CMP reads the
navigator.globalPrivacyControlproperty. - Confirm that no Consent Notice appears (because GPC should pre-reject Non-Essential Cookies).
- Verify that no third-party tags fire on page load.
Pass condition: GPC-enabled visits behave identically to manual opt-outs. No tracking, no banner.
Common failure: The site ignores GPC entirely, or shows a banner asking users to confirm what they've already signaled. Tractor Supply and Healthline Media both settled enforcement actions that explicitly cited GPC failures. Twelve states now require businesses to honor these signals.
3. Dark Pattern Audit
What you're checking: Is your consent flow neutral, or does it steer users toward acceptance?
How to audit:
- Count the clicks required to accept versus reject.
- Measure button sizes and visual prominence (reject should be equal to accept).
- Check whether rejection requires navigation to a separate preferences page.
- Look for pre-selected boxes in granular consent settings.
- Note any confirm-shaming language ("Reject and miss out on personalized content").
Pass condition: Symmetry of Choice and Equal Prominence. One-click reject, no pre-selections, no misleading copy.
Common failure: Accept is a big green button; reject is a gray text link. Or rejection requires filling out a form with name, email, and phone number. Sling TV's opt-out required all of that information and was buried inside a general preferences center. The CCPA now explicitly prohibits dark patterns as of January 2026.
4. Vendor Contract and Tag Alignment
What you're checking: Do your vendor contracts match the purposes disclosed in your privacy policy?
How to audit:
- List every third-party tag on your site (use your Tag Manager or a cookie scanner).
- For each vendor, pull the contract or data processing agreement.
- Compare the permitted use cases in the contract to the purposes you've disclosed to users.
- Flag any vendor authorized for "any business purpose" or similar open-ended language.
Pass condition: Every vendor contract contains purpose limitations that match your notice. No vendor has broader permissions than what you've told users.
Common failure: Ad-tech contracts that allow partners to use data for "any business purpose." Healthline's contracts used exactly that language, and it contributed to their $1.55 million penalty. General Motors sold OnStar data to data brokers for insurance rate-setting despite contracts explicitly forbidding it, resulting in a $12.75 million penalty.
5. Age-Assurance and Sensitive Data Gates
What you're checking: Are you collecting opt-in consent before selling or sharing data from 13-to-16-year-olds or processing sensitive data categories?
How to audit:
- Check whether your site has an age gate or age-verification mechanism.
- If you collect health, geolocation, biometric, or other sensitive data categories, confirm that you're securing opt-in consent (not just opt-out) before sharing it with third parties.
- Review your CMP configuration: is there a separate consent layer for sensitive categories?
Pass condition: Affirmative opt-in before selling or sharing data from users aged 13-16. Separate opt-in for sensitive data processing.
Common failure: Treating COPPA's under-13 threshold as the only age boundary that matters. Jam City, PlayOn Sports, and Roku all faced enforcement for collecting data from 13-to-16-year-olds without required consent. Healthline's penalty was tied partly to sharing health-article URLs with advertisers without opt-in.
6. Privacy Policy Accuracy and Freshness
What you're checking: Does your notice describe what you actually do, and is it current?
How to audit:
- Compare your privacy policy's processing disclosures to your actual data flows (use a data map if you have one).
- Check the last-updated date: CCPA requires annual updates.
- Confirm that all applicable state rights are listed (don't list California and Colorado but leave out Oregon).
- If you process job applicant data, confirm that your notice covers applicants, not just customers.
Pass condition: The notice matches reality. It's been updated within the last 12 months. It covers all user types and all states where you have obligations.
Common failure: A notice that hasn't been touched in two years, or one that's "largely unreadable" (Connecticut's exact words in the TicketNetwork action). Tractor Supply was flagged for both a stale notice and failing to tell job applicants their rights applied.
7. Subject Rights Request Workflow Test
What you're checking: Can users actually exercise their rights within statutory timelines, and do they get complete responses?
How to test:
- Submit a test access request through your own intake form.
- Track whether you receive it in your workflow system.
- Confirm that the 45-day clock starts automatically.
- When the response comes back, check whether it's complete (all data categories, all processing purposes, all third parties).
- Test a deletion request and verify that the data is actually purged from your systems and vendor systems.
Pass condition: Requests are acknowledged within the statutory window. Responses are complete and accurate. Deletion requests propagate to vendors.
Common failure: Requests time out, or the response is partial. The California Privacy Protection Agency opened its first sectoral audit in July 2026 specifically to check whether gig platforms honor access requests within 45 days and whether responses are actually complete. Audit findings can be referred straight to enforcement.
Customizing This Checklist
Add state-specific tests based on where you operate. If you're subject to the Colorado Privacy Act, add a test for universal opt-out mechanisms beyond GPC. If you're under Virginia's VCDPA, confirm that your appeal process is documented and functional.
If you operate in a regulated sector (health, finance, education), layer in sector-specific requirements. HIPAA-covered entities need to verify that their Business Associate Agreements align with CCPA vendor contract standards.
If your site uses AI-driven personalization or automated decision-making, add a test for logic disclosure: can users actually understand how decisions are made, and can they opt out?
Validation Steps
Run this audit quarterly and after any CMP configuration change. Document your findings in a compliance log that includes:
- Date of audit
- Who ran it
- Pass/fail status for each test
- Remediation steps for failures
- Re-test date for any failed items
When you find a failure, don't just fix the technical issue. Trace it back to the process gap that allowed it to happen. If your opt-out doesn't work, the problem isn't just a misconfigured tag. It's that no one tested the opt-out after the CMP was deployed. Fix the process, not just the symptom.
If you're not sure where to start or don't have the internal resources to run these tests manually, automated tools exist. Osano's Compliance Check runs regular scans against your website to see if it passes or fails the standards regulators are actively enforcing, including GPC compliance and dark pattern detection.
The gap between what your site claims and what it does is measurable. Measure it before someone else does.
