Most website privacy problems can be found in an afternoon with a browser, a notepad and the site's own privacy notice. This audit walks through the three areas that cause the most trouble: what the notice says, what the cookies and tags do, and how people can send you requests. It scores the answers as you go.
Pick the audiences you serve first. Items that only apply under EU/UK rules or US state laws are hidden when that audience is switched off. Tick an item only when you've checked the live site, not the policy document or what the agency said it set up. Nothing you tick is sent or saved. This is a self-check, not legal advice, and a full score doesn't mean you're compliant.
Before you start
Open the site in a private browser window with developer tools open on the Network tab. For the cookie section you'll want to see which requests fire before you click anything on the banner. If your audience includes the US, install or enable a browser that sends Global Privacy Control (GPC). Some browsers send it by default, and others need an extension. You can check what your browser is sending at the GPC project site.
1. Privacy notice contents
GDPR Article 13 lists what you must tell people when you collect their data. The CCPA (Civil Code §1798.100 and §1798.130) and its regulations add California-specific contents. Read your published notice against these.
2. Cookies, consent and Global Privacy Control
In the EU and UK, the ePrivacy rules (in the UK, PECR) require consent before you store or read non-essential cookies and similar identifiers on a device. US state laws mostly work on opt-out: you can run advertising tags, but you must let people opt out of sale, sharing and targeted advertising, and many states require you to treat a browser opt-out signal as a valid opt-out.
3. Request intake
This section checks how people can reach you with access, deletion, correction or opt-out requests, and whether your first response follows the rules. For the full workflow, see Handling data subject requests and Data subject request automation.
Your results and what to fix first
Items carry different weights. Pre-consent tags in Europe and unhonored GPC signals in the US count most, because they're easy for a regulator (or a plaintiff's lawyer) to test from outside. Fix those first. They're usually configuration problems in the consent tool or tag manager, not rebuilds.
Then fix the notice, which is mostly writing. Then the intake process, which needs an owner more than technology. If request volume is growing, it's worth reading Choosing privacy software without regretting it before you buy a tool, and scoring vendors with the buyer's checklist.
What this audit doesn't cover
It's a check of what's visible from outside. It doesn't cover your data inventory (see Data mapping and discovery), vendor contracts (see Data processing agreements), security controls (see Security controls for personal data), children's data, health data rules or sector laws. It also doesn't decide which laws apply to you, since US state laws have revenue and volume thresholds. For a program-level view, see Planning a privacy program: the first 90 days.