GDPR and CCPA gaps DTC ecommerce ops teams keep missing

A privacy audit needs evidence from the data flows that actually run. The cookie banner is one surface in that review. Browser requests, server queues, imported contacts, vendors, and rights request handling need to match the policy the business has adopted.

This guide combines a seven checkpoint audit with the earlier six gap overview. It describes an engineering review for a qualified privacy team to evaluate against the applicable law and facts.

The seven checkpoints

1. Capture when tracking requests begin relative to the applicable choice. Save accepted, declined, and returning visitor examples.
2. Inspect analytics payloads, URLs, and custom dimensions for identifiers. Hashing can leave data linkable and does not automatically make a field anonymous.
3. Follow consent provenance for imported email contacts. Record where the contact and permission came from, the purpose, and any later withdrawal.
4. Trace server forwarding and queued work. Verify that the applicable decision reaches the sender, including the path used for a retry.
5. Test the rights request workflow from intake through identity verification, search, response, and completion. Apply the relevant deadlines and exceptions with the privacy reviewer.
6. Compare each receiving vendor and purpose with the notice, contract, data flow, and retention record.
7. Review territorial scope, business criteria, and any representative obligations against the actual markets and activities.

How to run the evidence pass

Use a controlled test identity and walk landing, product, cart, checkout, and confirmation flows. Capture the domains and payload shapes without retaining real customer records in a review artifact. Repeat with the relevant choices and opt out signals.

Follow a test event into the server sender. Compare what the browser recorded with what a queued job later forwards. A disabled browser pixel leaves an unanswered question if the server still sends a purchase through another integration.

Select an imported contact and follow its provenance into the marketing platform. Confirm how an unsubscribe or withdrawal updates future use. The record needs to explain the permission for the particular purpose, including when it changed.

Exercise a rights request with the support and privacy owners. Record the systems searched, the response owner, and the completion evidence. A shared inbox can be one intake channel, but the case still needs a tracked owner and deadline.

Turn findings into a reviewed fix list

For each finding, save the source system, affected purpose, observed behavior, expected behavior, owner, and retest. Have the qualified privacy reviewer determine the legal interpretation and priority. The engineer can then change the tag gate, sender, import path, or workflow against a defined requirement.

These checkpoints organize the evidence. They do not establish that every request, identifier, or vendor transfer has the same legal treatment.

The six gap review and the consent event

The earlier six gap list fits inside this audit's seven checkpoints. Check whether tracking begins before the choice that should gate it, whether a server forward follows the applicable choice, how rights requests enter the workflow, what evidence proves the choice, which vendors receive the data, and whether the banner behavior matches the notice.

Consent stored as a single current boolean loses the history. A small event record can retain the decision, purpose, notice version, collection surface, and time. Keep the record minimal and protect it as personal data when it can be linked to a person.

{
  "event": "privacy_choice_recorded",
  "subject_ref": "opaque-test-subject",
  "recorded_at": "2026-10-23T12:00:00Z",
  "purpose": "advertising",
  "choice": "declined",
  "notice_version": "2026-10",
  "surface": "storefront-banner"
}

This is an illustrative shape. A later withdrawal is another event, and the sending path needs to use the applicable current choice. Audit the queue as well as the page: a background sender should check the decision before forwarding a queued event. Include where the choice came from so imported contacts do not lose their provenance.

The EDPB consent guidelines describe demonstrable consent and withdrawal where consent is the processing basis. GDPR has other lawful bases, and electronic marketing and device access rules can add requirements. Have the legal review identify the purpose and applicable rule before translating it into tag conditions.

CCPA applies when its business criteria are met. A server API or hashed identifier can still involve personal information, and whether a transfer is sale or sharing depends on its facts and statutory exceptions. The California Attorney General's CCPA guide covers consumer rights and opt out signals, including Global Privacy Control. Test those signals on both browser collection and server forwarding.

Territorial scope also needs a real assessment. The EDPB territorial scope guidance explains why mere website accessibility in the EU does not by itself establish an offer of goods or services there. Avoid treating one EU visit as a complete scope test.