What is a cookie banner audit? (2026 checklist)

The cookie banner is the single most-audited compliance surface on a website. It is the first thing a regulator sees, the easiest thing for a complainant to screenshot, and the source of most public GDPR fines. A cookie banner audit is the check that tells you whether yours would pass scrutiny.

This article is the 2026 checklist, what auditors look at, the dark patterns regulators have specifically called out, and the design that consistently passes review across the EU and UK.

What an auditor checks, in order

1. The first impression

• The banner appears before any non-essential script fires. (Verify with a network tab or a scanner.)
• The banner is visible without scrolling on the device the user is on, including narrow mobile viewports. Check this by hand on a real phone width: automated scanners, ours included, render at a single desktop viewport and will never see a banner that only breaks at 375px.
• The banner does not auto-close. Implied consent (closing the banner, scrolling, continuing to use the site) is not consent.

2. The choices on the first layer

• Accept all and Reject all buttons appear at the same level, same screen, same prominence, comparable visual weight.
• A third option for granular settings (Manage preferences) is visible but not the only alternative to Accept.
• No pre-checked categories. All non-essential categories default to off until the user explicitly toggles them on.

3. The granular layer

• At minimum: strictly necessary, functional, analytics/statistics, advertising/marketing. Many regulators expect finer categories, e.g., separate toggles for personalisation and social media.
• Each category has a plain-language description of what it does and which vendors are involved.
• No legitimate-interest toggle for advertising. The IAB’s TCF v2.0 originally allowed it; the Belgian DPA found that pattern unlawful in 2022.
• A Save preferences button that respects partial choices.

4. Withdrawal

• A persistent “Cookie settings” link, ideally in the footer, opens the same banner so the user can change their choice.
• Withdrawal is as easy as the original consent, one click, same modal.

5. Behavioural verification (do this one by hand)

This is the step no scanner does for you, and it is worth understanding why rather than assuming a tool has covered it. Testing what happens after Accept or after Reject means clicking Accept or Reject. A click is a consent gesture. An automated crawler that presses the button has destroyed the measurement everyone actually needs, which is what your site loads for a visitor who has not chosen anything yet. Veracly makes that trade deliberately: we take the pre-consent reading and leave the post-consent paths to you. Open a fresh private window and reload after each path:

• Accept all, every script fires; cookies match the cookie policy.
• Reject all, only strictly-necessary cookies; no analytics, no advertising, no third-party widgets that set cookies.
• Granular partial, only the categories the user toggled on fire.

Most banners pass on Accept and fail on Reject. A common failure: a Google Tag Manager container that loads regardless of consent, with individual tags loaded inside it that also fire regardless. The fix is to gate the entire GTM container behind consent or to move the consent check into every tag.

The dark patterns regulators have specifically called out

The EDPB Cookie Banner Taskforce published a final report in January 2023 setting out where the national authorities found common ground on complaints about banners. It is careful to say what it is not: a common denominator, a minimum threshold, and explicitly not something that prejudges any authority’s own analysis under its national law. Treat the list below as the floor rather than the standard, and check your own regulator for anything stricter.

• No Reject button on the first layer.
• Pre-ticked boxes.
• Deceptive button design, where the styling itself steers the choice. Read the scope here precisely, because it is widely overstated: the taskforce refused to impose any general standard on colour or contrast, and condemns contrast only where the text becomes effectively unreadable. Greying Reject into illegibility is the named defect. “Accept is green and Reject is red” is not, on its own, an EU rule.
• Misleading language, “Accept and visit” vs. “Reject,” or “by clicking, you accept.”
• Categories described in legal jargon that an average user cannot understand.
• Legitimate-interest justification for advertising.
• Cookie wall (you must accept to view content) on services where alternatives are not available.
• Re-prompting the user on every page load after they have rejected.

What good looks like

A banner that consistently passes audits has the following structure:

1. Plain-language summary: “We use cookies to make this site work and, with your permission, to understand how it’s used and improve it.”
2. Three buttons of equal visual weight: Accept all, Reject all, Manage preferences.
3. Manage preferences opens a modal with toggles for each non-essential category, defaulting to off, with vendor lists and purpose descriptions.
4. A Save preferences button alongside the same three top-level choices.
5. A persistent footer link labelled “Cookie settings” that re-opens the modal.
6. An accessible cookie policy page that lists every cookie, name, purpose, duration, first/third party, and is regenerated when the inventory changes.

How Veracly audits banners

Veracly visits your site as a fresh user and records the third-party network calls, cookies, and storage keys that appear before any consent gesture. Requests to your own hostname are not recorded, and storage is captured as keys and database names, never values. It then inspects the banner markup itself: reject-button parity against the accept button, rejects hidden behind a “Customize” submenu or pushed off-screen, and pre-ticked category checkboxes. Banner findings carry one citation pair, CNIL deliberation 2020-091 and the EDPB Cookie Banner Taskforce report, plus the developer fix. We do not tailor the citation to your national regulator, and where the banner’s buttons cannot be enumerated at all, the parity verdict is withheld rather than guessed. Run a scan to audit your current banner.

See also: What is a GDPR cookie audit? · Tracking pixel audit: GDPR & ePrivacy