08
GDPR and cookie consent.
A cookie banner that actually blocks: zero cookies before consent, withdrawal that deletes, and documents written against the real configuration. Quoted from the audit findings + VAT.
Quoted from the audit findings + VAT
We measure what your site does before consent, fix the blocking and the withdrawal path, then write the privacy and cookie policies from the real configuration rather than the other way round.
In short
- An audit with numbers: how many cookies land before consent
- Real blocking: zero third-party requests before the banner is answered
- Withdrawal that actually deletes cookies from the browser
- Privacy and cookie policy written from the measured configuration
- Quoted from the audit findings, after the €200 audit
What we measure in the audit, and why numbers beat opinions
The audit runs in a clean browser session: no logins, no old cookies. We count how many cookies land before the banner is touched, which third-party servers receive a request, whether Google Consent Mode activates at all, and what withdrawing consent actually deletes.
The result is a “now / should be” table where every row is a number, not a judgement. It can be repeated a month later and compared. We do not write a thick PDF of general phrases.
Why a cookie banner often blocks nothing
A banner on the page is not blocking. The common causes we find: a plugin rewrites the page markup and the Google consent signal never reaches its destination; Tag Manager creates a script at runtime, so the consent platform never sees it; the same container is injected twice and only one of the two sits behind consent.
The hardest case is server-side tracking. Order data leaves the server straight for the ad platform, nothing shows up in the browser, so nobody notices. That is the send we find and stop first.
Withdrawal that actually deletes the cookies
GDPR Art. 7(3) requires withdrawing consent to be as easy as giving it. In practice the consent platform clears its own cookies while the analytics and advertising cookies stay in the browser for another two years.
On one site we measured that withdrawal removed one cookie out of twenty-two. After the fix the number is zero: the signal is switched off and the cookies are deleted from the device, not merely marked unused.
Documents written from the measured configuration
First we list who actually receives data: analytics, ad platforms, payments, couriers, email systems, chat widgets, hosting. For each one: what they get, on what legal basis, where it is stored and for how long. Only then is the policy written.
A policy describing protections that do not exist is a liability of its own. On one site it described blocking for embedded videos while the site had no embedded video at all. We rewrite that text rather than leave it sounding good.
Pricing: quoted from the audit findings
We start with the website audit: a fixed €200 + VAT, and it checks the whole site rather than consent alone. Only then is it clear how many systems are involved: one banner and the documents, or Tag Manager, ad pixels and server-side sending as well.
Remediation is quoted from the findings rather than from a guess. The audit report is yours even if you continue with another team. Get in touch.
FAQ.
Where do we start?
With the website audit, €200 + VAT. It shows how many cookies land before consent, what withdrawal deletes, and which systems send data. Remediation is quoted from those findings.
Can you do the documents only?
We can, but we will say it plainly: a policy without measurement is guesswork. On a tight budget, do the audit first and the documents from it.
Does this work for non-WordPress sites?
Yes. We measure in the browser, not in a plugin list, so the method is the same for WordPress, Shopify, custom or headless. Only the remediation work differs.
Do you guarantee we will not be fined?
No. Nobody can. We guarantee a measured state, the evidence behind it, and documents that match what the site actually does.