Cookie Audit Checklist
Every Third-Party Cookie, Traced to a Vendor Agreement
Map each vendor's role, confirm the DPA or controller terms that match it, and treat a missing agreement as a blocking finding.
You ran the scan, but you still cannot prove the paperwork is on file
Your cookie scan surfaces doubleclick.net, facebook.com, and a dozen ad-tech domains you did not place yourself. Surfacing them is only the first step. For each one you need to know who the vendor is, whether they act as a processor, independent controller, or joint controller, and whether the agreement that matches that role is current. Third-party cookies carry the highest compliance risk in any audit, and an advertising identifier firing with no valid consent basis is a direct exposure under GDPR Article 5(1)(a) and CCPA opt-out rules.
What's inside
What the third-party and vendor-agreement steps cover
The outcome
What you can do once you have worked through it
Credibility
Grounded in named frameworks and regulator guidance
Frequently asked questions
It is a concrete, numbered task list of 27 steps across 9 sections, built to be repeated each audit cycle rather than read once. It includes ready-to-use table structures for the cookie register, the findings log, and the CMP consent-record fields.
A scan surfaces the cookies, but it cannot tell you whether the right DPA is on file, which vendor is the controller, or whether a tag respects consent before firing. The checklist adds the scan-state methodology (no-consent, rejected, accepted) and the vendor-agreement and tag-firing checks that turn raw scan output into a defensible record.
Yes. It names CCPA and CPRA opt-out rules, Quebec Law 25, Brazil LGPD, and signals such as Global Privacy Control and IAB TCF v2.3, so you can scope jurisdiction-specific rules to the right user populations.
No. The checklist is provided for general informational and educational purposes only and does not constitute legal or compliance advice. It carries a full disclaimer and directs you to confirm exemptions, agreements, and durations with qualified counsel against current primary sources.
Cookie Audit Checklist