Website Compliance Checklist: GDPR, CCPA, and Beyond

Running a website in 2026 means navigating a complex web of privacy regulations. The GDPR covers the European Union, CCPA/CPRA protects California residents, the UK GDPR applies post-Brexit, Germany's DSGVO adds its own interpretations, and dozens of other jurisdictions have enacted or updated their own privacy laws.

This checklist provides a practical framework for evaluating your website's compliance posture across the regulations that matter most.

GDPR Compliance Checklist (EU/EEA)

The General Data Protection Regulation applies to any website that processes personal data of individuals in the European Economic Area, regardless of where the website operator is located.

Consent and Cookies

• [ ] Non-essential cookies are blocked until the user provides explicit consent
• [ ] The consent banner provides clear "accept" and "reject" options at the same level of prominence
• [ ] Granular controls allow users to choose between cookie categories (analytics, marketing, functional)
• [ ] Pre-ticked checkboxes are not used for any consent mechanism
• [ ] Consent records are stored with timestamps, user identifiers, and the specific choices made
• [ ] Users can withdraw consent at any time through an accessible mechanism (footer link, persistent widget)
• [ ] Consent preferences are respected across all pages and subdomains
• [ ] Google Consent Mode v2 signals are correctly sent when using Google services

Privacy Policy

• [ ] A privacy policy is published and accessible from every page
• [ ] The policy identifies the data controller and provides contact information
• [ ] All categories of personal data collected are listed with their purposes
• [ ] The legal basis for each processing activity is specified (consent, legitimate interest, contract)
• [ ] Third-party data processors are identified along with their purposes
• [ ] Data retention periods are specified for each category of data
• [ ] International data transfer mechanisms are documented (SCCs, adequacy decisions)
• [ ] User rights are clearly explained: access, rectification, erasure, portability, objection

Data Processing

• [ ] A Record of Processing Activities (ROPA) is maintained
• [ ] Data processing agreements are in place with all third-party processors
• [ ] A Data Protection Impact Assessment has been conducted for high-risk processing
• [ ] Data minimization is practiced: only necessary data is collected
• [ ] Personal data is encrypted in transit (HTTPS) and at rest where applicable
• [ ] Access to personal data is restricted to authorized personnel

Data Subject Rights

• [ ] A process exists for handling data access requests within the 30-day deadline
• [ ] Users can request deletion of their personal data
• [ ] Data portability requests can be fulfilled in a machine-readable format
• [ ] Right to object to processing (particularly for direct marketing) is implemented
• [ ] Automated decision-making processes include human review options where required

CCPA/CPRA Checklist (California)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to businesses that meet specific revenue or data processing thresholds and handle data of California residents.

Notice and Disclosure

• [ ] A "Do Not Sell or Share My Personal Information" link is visible on the website
• [ ] The privacy policy discloses the categories of personal information collected in the past 12 months
• [ ] The business or commercial purpose for collecting each category is stated
• [ ] Categories of third parties with whom data is shared are disclosed
• [ ] The privacy policy has been updated within the past 12 months

Consumer Rights

• [ ] Consumers can request to know what personal information has been collected about them
• [ ] A mechanism exists for consumers to request deletion of their personal information
• [ ] Consumers can opt out of the sale or sharing of their personal information
• [ ] Consumers can limit the use of sensitive personal information
• [ ] Requests are processed within the 45-day response window
• [ ] The business does not discriminate against consumers who exercise their rights

Data Handling

• [ ] Contracts with service providers include CCPA-compliant data processing terms
• [ ] Sensitive personal information (SSN, financial accounts, geolocation, biometric) has additional protections
• [ ] Data retention schedules are defined and enforced
• [ ] Reasonable security measures are in place to protect personal information

UK GDPR Checklist

After Brexit, the UK adopted its own version of the GDPR that largely mirrors the EU regulation but is enforced by the Information Commissioner's Office (ICO) rather than EU data protection authorities.

Key Differences to Verify

• [ ] A UK representative is appointed if the organization is not established in the UK but processes UK residents' data
• [ ] The ICO is listed as the supervisory authority in UK-facing privacy documentation
• [ ] International data transfers from the UK use UK-approved mechanisms (UK SCCs, UK adequacy regulations)
• [ ] Age of consent for children's data processing is set at 13 (not the EU default of 16)
• [ ] Cookie consent implementation meets ICO guidance, which requires prior consent for analytics cookies

ICO-Specific Requirements

The ICO has been particularly active in enforcing cookie compliance. Their guidance explicitly states that analytics cookies require consent and that implied consent (continuing to browse) is not valid. Ensure your consent mechanism meets ICO standards even if it already satisfies EU GDPR requirements.

DSGVO Considerations (Germany)

Germany's implementation of the GDPR (Datenschutz-Grundverordnung) is enforced by both the federal and state-level data protection authorities, who have taken particularly strict positions on several issues.

German-Specific Requirements

• [ ] TTDSG (Telekommunikation-Telemedien-Datenschutz-Gesetz) requirements for cookies and tracking are met
• [ ] Consent banners do not use dark patterns (German courts have been especially strict on this)
• [ ] Server logs containing IP addresses are treated as personal data and have defined retention periods
• [ ] A Data Protection Officer is appointed if the organization meets German thresholds (generally 20+ employees regularly processing personal data)
• [ ] Data processing agreements (Auftragsverarbeitungsvertrag) are in place with all processors

Common Compliance Gaps

Even organizations that take compliance seriously often have gaps in their implementation. These are the most frequently identified issues across audits:

Third-Party Scripts

Most websites load 10 to 30 third-party scripts: analytics, advertising, chatbots, heatmaps, social media widgets, A/B testing tools, and more. Each of these may set cookies and collect personal data. A common gap is that the consent banner controls only a subset of these scripts while others load freely.

Action: Audit every script loaded on your website. Categorize each one and ensure your consent mechanism controls all non-essential scripts.

Cross-Border Data Transfers

If your website uses services hosted outside the EU (or outside the UK, for UK compliance), you need a legal mechanism for the data transfer. Standard Contractual Clauses are the most common approach, but they require a Transfer Impact Assessment to evaluate the legal framework of the destination country.

Action: Map where your data flows. For each non-EU/non-UK processor, verify that appropriate transfer mechanisms are in place.

Mobile and App Compliance

If your website has a corresponding mobile app, the same privacy requirements apply but are often implemented inconsistently. The app may use different analytics, request different permissions, or have a separate (outdated) privacy policy.

Action: Ensure your mobile app's data collection, consent mechanisms, and privacy disclosures are consistent with your website.

Employee Access Controls

Compliance extends beyond the website itself. If multiple employees have access to analytics dashboards, customer data, or consent records, appropriate access controls must be in place.

Action: Review who has access to personal data within your analytics and CRM systems. Implement role-based access where possible.

Tools You Need

Maintaining compliance across multiple regulations requires the right tooling:

Consent Management Platform. A CMP that handles cookie blocking, granular consent collection, consent storage, and consent signal forwarding (Consent Mode v2).

Analytics with Built-In Compliance. Analytics that respect consent signals natively, offer cookieless tracking for non-consented visitors, and process data in compliant jurisdictions.

Website Auditing. Regular automated scans to detect new third-party scripts, cookies, and trackers that may have been added without going through the consent process.

Data Request Management. A system to receive, track, and fulfill data subject access requests within regulatory deadlines.

Getting Started with Conseto

Conseto consolidates consent management, privacy-first analytics, and website auditing into a single platform. Instead of stitching together separate tools for your CMP, analytics, and compliance monitoring, one script covers GDPR, CCPA, UK GDPR, and DSGVO requirements with automatic consent handling and built-in audit capabilities. Explore the full compliance stack at conseto.io.