The 15-Step Checklist

1. Install a Certified CMP

Your consent management platform must be Google Certified and IAB Europe registered. This ensures compliance with both Consent Mode V2 and TCF 2.3.

2. Audit All Cookies and Trackers

Scan your site for every cookie, pixel, SDK, and local storage item. Classify each as strictly necessary, analytics, or advertising. Remove anything you cannot justify.

3. Configure Your Consent Banner

Ensure equal Accept/Reject buttons, clear language in the visitor's native tongue, and no pre-checked boxes. The banner must appear before any non-essential tracking fires.

4. Set Default Consent to Denied

For EEA visitors, all non-essential consent categories must default to denied. Only strictly necessary cookies may fire without consent.

5. Publish a Privacy Policy

Your privacy policy must explain what data you collect, why, the legal basis, who receives it, retention periods, and how users can exercise their rights.

6. Publish a Cookie Policy

List every cookie, its purpose, duration, and whether it is first-party or third-party. Link this from your consent banner.

7. Enable Google Consent Mode V2

Configure Advanced mode so Google tags fire in restricted mode before consent, then switch to full tracking after consent.

8. Enable IAB TCF 2.3

If you run programmatic advertising, your CMP must generate valid TC Strings. Verify with the IAB's TCF validator tool.

9. Sign Data Processing Agreements

Every third-party that receives personal data from your site needs a DPA. Google, Meta, analytics providers, email platforms — all of them.

10. Maintain a Record of Processing Activities

Document every data processing operation: what data, what purpose, what legal basis, what recipients, what retention period.

11. Implement Data Subject Rights

Set up processes for access requests, deletion requests, data portability, and objections. Respond within 30 days.

12. Configure Data Retention

Do not keep personal data longer than necessary. Set retention periods in Google Analytics, your CRM, email platform, and databases.

13. Secure Your Data

HTTPS everywhere, encrypted databases, access controls, regular security audits. Data breaches must be reported to your supervisory authority within 72 hours.

14. Train Your Team

Everyone who handles personal data needs GDPR training — marketing, sales, support, engineering. Document the training.

15. Schedule Regular Audits

Review your compliance quarterly. New cookies appear when you add tools. Policies need updating. Consent rates need monitoring.

The Cost of Non-Compliance

FlexyConsent Covers Steps 1-8 Automatically