As of 13 August 2026, AI can only partly audit your website cookies for PECR compliance.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the website in a clean browser session and record the URL, visible consent banner, banner choices and links to the cookie policy.
   2. Run a cookie and tracking scan before making a consent choice, then export the complete results with names, domains, providers, purposes and load times.
   3. Repeat the test after accepting, rejecting and withdrawing consent for each available category, and save screenshots, network logs and the consent-management-platform settings.
   4. Gather the current cookie policy, tag-manager or developer documentation, vendor descriptions and the current ICO PECR guidance relevant to cookies and similar technologies.
   5. Paste the evidence and guidance into the prompt, then ask the model to separate observed behaviour, missing evidence, possible issues and remediation actions.
   6. Compare every table entry with the scan export and test logs, correct any invented or mismatched item, then send the unresolved legal findings and evidence to a UK data-protection solicitor or qualified privacy professional before publishing changes.

   Prompt

   Act as a UK privacy-audit assistant. Prepare a preliminary audit of the website cookies and tracking technologies using only the evidence and guidance I provide. This is not professional advice and you must not give a final legal sign-off.
   
   Website address: [WEBSITE ADDRESS]
   Business and website purpose: [SHORT DESCRIPTION]
   UK visitors and services affected: [DESCRIPTION]
   Cookie scan export: [PASTE OR ATTACH THE FULL EXPORT]
   Consent-management-platform settings and banner text: [PASTE OR ATTACH]
   Test results before consent, after accepting, after rejecting and after withdrawing consent: [PASTE OR ATTACH]
   Relevant scripts, tags, vendors and cookie purposes: [PASTE OR ATTACH]
   Current ICO PECR guidance or other authoritative material to use: [PASTE OR ATTACH]
   
   Produce:
   1. A table of every observed cookie or tracking technology, including name, domain, provider, purpose, category, duration, whether it is first-party or third-party, and the evidence for each entry.
   2. A separate table of observations about what loads before consent, after consent, after rejection and after withdrawal.
   3. A finding for each item marked supported observation, possible PECR issue, missing evidence or no issue apparent from the supplied evidence. Do not treat missing evidence as compliance.
   4. The exact evidence needed to resolve every uncertain finding.
   5. Practical remediation actions for the website owner, clearly separated from legal conclusions.
   6. A short list of questions that a UK data-protection solicitor or qualified privacy professional must answer before the audit is relied on.
   
   Do not invent cookie names, vendors, purposes, consent records, legal citations or test results. Do not assume that a cookie is exempt merely because it is labelled necessary or analytics. Quote or identify the supplied guidance for each legal assessment, state when the material is insufficient, and distinguish technical observations from PECR conclusions.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.