KYCookies Web Compliance Audit
Find out what is really happening across your web estate.
Most organisations assume their website is working as intended. Most are wrong about at least some of it. In the context of regulatory action around cookies, hidden trackers, and consent especially, this is a significant blind spot.
Cookies dropping when they should not. Consent banners quietly corrupting analytics data. Tracking nobody fully mapped, including server-side and hidden trackers that a standard cookie scan will not pick up. Policies that do not reflect what the site actually does. None of these are edge cases, and they each pose risk. It only takes one customer complaint to escalate to a regulator.
KYCookies gives you an honest, independent picture of where you stand: technically, regulatorily and commercially.
Every audit is delivered by a senior team. Our proprietary automated scanning tests what your site actually does, before and after consent; a senior regulatory specialist then reviews the findings against current UK and EU requirements, including ICO guidance and EDPB positions. Our CTO brings over a decade of full-stack development and engineering experience across global agencies and in-house technology roles at a FTSE 100 organisation. Our CEO was the strategic legal lead for website transformation of global web estates at both a FTSE 100 and a major US technology company; and brings the regulatory overlay across GDPR, UK GDPR, ePrivacy, CCPA, CPRA, LGPD and beyond.
Does any of this sound familiar?
Consent that feels uncertain, or hurts analytics.>Your banner is live, yet you are unsure whether it is genuinely compliant or quietly distorting your marketing data.
Unmapped tracking and legacy blind spots.>You suspect server-side tags, hidden trackers, or code from a previous build are firing without oversight.
High-stakes scrutiny without the evidence.>You need to demonstrate web compliance to a regulator, investor, or enterprise customer, and cannot back it up yet.
No clear business case for the board.>You know your web estate needs investment, but lack an independent view of what needs fixing and why it matters.
What we check
Every KYCookies audit covers the technical and regulatory fundamentals across your site:
- Cookies and tracking technologies: What fires, loads, and stores data across your pages.
- Consent mechanisms: Banner configuration, choice architecture, and signal enforcement.
- Privacy disclosures: Notices and data capture points on forms.
- Third-party data sharing: External pixels, tags, and vendor endpoints receiving visitor data.
- Footer links and legal documents: Accuracy and availability of privacy notices, cookie policies, and terms.
- HTTPS and mixed content: Core transport security and unencrypted asset checks.
Automated tools alone generally capture less than half of web compliance issues - missing legal context, regulatory interpretation, dark patterns, and sector-specific rules. Every audit pairs our proprietary scanning with senior regulatory analysis.
Tiers & delivery
Pricing depends on two factors: whether your website is informational or transactional, and the number of tracking technologies present. We confirm the exact scope and fixed fee after a short, no-obligation scoping call.
| Feature | Snapshot | Audit | Comprehensive |
|---|---|---|---|
| Scope | Homepage only | Agreed page set (5-20 pages) | Full site |
| User paths | None | Up to 3 agreed paths | All key user paths |
| Consent states | Before consent and after reject | All consent states | All consent states |
| Forms | Homepage forms only | All forms on reviewed pages | All forms across full site |
| Dark patterns | Consent banner | Consent and sign-up flows | All key flows |
| Senior regulatory overlay | Included | Included | Included |
| Deliverables | Summary report | Report with raw data appendix | Report with raw data appendix, plus live findings walkthrough |
| Best for | A quick, evidence-based view of where you stand | A thorough review of your most important pages and user journeys | A complete audit across your full site, with an actionable remediation roadmap |
Senior regulatory analysis is built in. Every report includes regulatory interpretation by a senior privacy specialist, applied against current ICO and EDPB positions. This is included as standard at every tier - never sold as an optional add-on.
Additional modules
Optional modules can be added to any tier and scoped during your initial call. Where not already included in your chosen tier, you can add:
- UX & Journeys: Extended dark pattern review, email marketing flows, and multi-factor authentication (MFA) checks.
- Privacy & Governance: Vendor and processor inventory, cross-border transfer safeguards, data subject rights (DSR) workflows, and incident response reviews.
- Emerging & Specialist Standards: AI transparency review and digital accessibility.
- Sector-specific Requirements: Financial services, food and HFSS, alcohol, and pharma and healthcare.
Need something specific? We also build tailored modules around your exact technical or regulatory requirements.
How it works
- Scoping call (no obligation, no charge): A short call to understand your website, your priorities, and which tier and modules fit best. Before any work begins, we confirm the agreed tier, modules, pages in scope, and fee in writing.
- Live visitor-experience scanning: Our proprietary tooling tests your website across the agreed scope exactly as a real visitor experiences it, capturing what loads, what is stored, and what is shared with third parties before and after each consent choice.
- Senior regulatory overlay: A senior privacy specialist reviews the technical scan data against current UK and EU requirements, separating genuine compliance exposure from raw scanner noise.
- Actionable report and walkthrough: You receive a structured report containing prioritised findings and practical recommendations. Our Comprehensive tier also includes a live walkthrough session with your team.
You cannot govern what you cannot see. Your findings give you the evidence base to meet compliance requirements, improve marketing data quality, build customer trust, and make the case for digital transformation investment.
Scope note: KYCookies covers front-end implementation and visible website behaviour. Backend data flows and wider processing operations are assessed separately within KYData Governance and KYData Privacy.
Read our latest on privacy and data >