Your website may collect much more than the cookies listed in its cookie banner. A marketing pixel can send purchase events to an advertising platform. A tag manager can add new scripts without a site release. Session-replay software can record clicks, scrolling and page content. Device fingerprinting can combine browser and device signals to recognise a visitor without relying on a conventional cookie.
For a growing business, this is not simply an IT issue. It is a measurement, customer-trust and governance issue. You need reliable conversion data to spend wisely, but you also need to know exactly what is happening on a customer’s device before, after and without their permission.
On 29 April 2026, the Information Commissioner’s Office published its final storage and access technologies guidance. It makes clear that the relevant PECR rules extend beyond cookies to tracking pixels, link decoration, web storage, fingerprinting, scripts and tags. Where personal data is involved, UK GDPR duties apply too.
This is a practical, non-technical process for ecommerce owners and marketers. It will not replace specialist legal advice where your setup is complex, but it will help you ask better questions, find hidden tracking and make sensible decisions before another campaign, plugin or agency script expands your data footprint.
Start with the right question: what does the visitor’s device do?
A weak audit starts and ends with a cookie-scanner report. A useful audit starts with the customer journey: when someone visits, searches, adds an item to basket, submits a form, checks out, logs in or reads an email, what code runs and what information leaves their browser?
The ICO calls these tools storage and access technologies. The important test is not whether something is labelled a cookie, first-party technology or server-side tracking. It is whether it stores information on, or accesses information from, a person’s phone, computer or other device, and why it does so.
That distinction matters. Moving an advertising tag to server-side tagging may change the technical route and may reduce browser activity, but it does not automatically make the underlying measurement privacy-neutral. Similarly, a first-party cookie can still support third-party advertising or identity matching. Focus on the purpose, the data flow and the organisations involved.
The main categories to look for
- Cookies: small browser files that may hold session IDs, preferences, analytics identifiers, attribution data or advertising IDs.
- Local and session storage: browser storage that can hold more data than a cookie. Local storage can remain until removed; session storage normally lasts for the visit.
- Pixels and conversion tags: small code elements that cause a browser to contact another server when a page, email or event is loaded.
- Scripts and tag-manager tags: JavaScript snippets used for analytics, chat, reviews, fraud prevention, personalisation, heatmaps and advertising. One tag can load several more.
- Session replay and heatmaps: tools that can capture click paths, mouse movement, scrolling, form interactions and visual reconstructions of pages.
- Fingerprinting: techniques that combine characteristics such as browser configuration, screen size, fonts, headers, APIs or network signals to distinguish a device or browser.
- Link decoration: extra URL parameters that identify a campaign, click, affiliate or potentially a person as they move between sites.
The ICO’s explanation of storage and access technologies is a helpful reference when a supplier says, “We do not use cookies.” That statement may be technically true while leaving out local storage, a pixel, a script that accesses device information, or a fingerprinting service.
Prepare a simple audit workspace
You do not need to become a developer to begin. Create a shared spreadsheet or document and appoint one owner: usually the person responsible for ecommerce, marketing operations or digital performance. Involve your web developer, agency and data-protection lead early. The aim is one factual inventory, rather than separate and contradictory lists held by marketing, IT and suppliers.
Create one row for every technology, tag or service you find. Give it these fields:
- Name of tool, cookie, script or storage key.
- Supplier and product name.
- Where it appears: all pages, checkout, account area, blog, landing page, email or app.
- Trigger: page load, consent, click, form submit, purchase, login or error.
- Purpose in plain English.
- Information collected, accessed or transmitted.
- Whether it creates an identifier or can be linked to an account, order, email address or IP address.
- Who receives the information, including downstream advertising, affiliate or identity partners where known.
- Storage type and duration.
- Your proposed category: exception, opt-out-based exception, or consent required.
- Evidence: scanner result, browser observation, tag-manager record, supplier documentation or developer confirmation.
- Decision and owner: retain, reconfigure, block pending consent, replace or remove.
Do not let a consent-management platform’s auto-categorisation become your inventory. It is a useful starting point, not proof that a technology’s purpose, duration or behaviour is correctly described. The ICO specifically advises organisations to review automatic categorisation as part of an audit.
Run the audit as a visitor, not as the site owner
Administrator accounts, office networks and returning browsers can hide what ordinary visitors experience. Test using a fresh browser profile or a separate device that is not signed into your company accounts. If possible, use a mobile phone as well as desktop, because responsive pages, payment flows and app-like features may load different tags.
Make four controlled visits
For each visit, record the cookies, local storage entries, scripts and network requests that appear. Browser developer tools can show these items, but a scanner or a developer can help you capture them. Take screenshots and export results where possible.
- Visit one: before any choice. Clear browser data, open the homepage and do nothing with the banner. Record what is already set or sent.
- Visit two: reject non-essential technologies. Use the most prominent reject or decline option. Browse key pages and confirm that advertising, replay and optional analytics tools do not start later.
- Visit three: accept selected categories. Accept only the category you are testing, then repeat the same journey. This reveals which tags are tied to which choice.
- Visit four: withdraw consent. Change preferences after accepting. Confirm that future tracking stops, stored identifiers are dealt with appropriately and partner signals are not still sent.
Repeat the exercise on pages that commonly escape oversight: campaign landing pages, product pages, search, basket, checkout, order confirmation, account creation, customer-service forms, recruitment pages and embedded booking or payment pages. Also test microsites, subdomains and any separate ecommerce platform. A clean main-site banner does not fix a checkout supplied by a different system.
Inspect the tag manager and the source of the site
Ask your developer or agency for read-only access to the tag manager, a current tag export and the list of website plugins. Look for paused tags, old containers, custom HTML, conversion APIs, social pixels, affiliate scripts and code installed directly in the website header or theme. A tag manager only reveals what is inside that manager; it will not necessarily show code placed by a plugin, an embedded widget, a payment provider or a developer.
Match every tag-manager entry against the browser test. If a tag is present in the manager but never loads, mark it as inactive and investigate why. If a browser request appears but there is no manager record, trace it to the website platform, plugin, app, embedded service or third-party script that loaded it.
Find the tracking that is easiest to miss
Pixels are data flows, not just invisible images
A conversion pixel may send an event when someone views a product, starts checkout or completes a purchase. Your audit should identify the event name, the receiving domain, the fields sent and whether the event includes identifiers, order values, product IDs, email addresses or hashed values. “Hashed” does not automatically mean anonymous; it can still be an identifier used to match someone across systems.
Check affiliate tracking carefully. A click may add an affiliate ID and timestamp to a URL, store it in the browser and then send transaction information when the customer reaches the thank-you page. The ICO gives an affiliate conversion-pixel example in which this process falls within regulation 6 of PECR. Your record should show exactly what sale information is passed and to whom.
Session replay deserves a separate review
Do not assume that a tool described as “UX analytics” merely reports aggregate numbers. Ask the supplier and your developer: does it record individual sessions? Does it reconstruct pages? Can it capture text, keystrokes, form fields, error messages, account pages or checkout steps? Are inputs masked by default, and have you tested that masking on your own live forms?
Recordings of individual visitors and the actions they take are not the same as aggregate page statistics. Treat replay as a higher-risk measurement activity. Limit it to pages and periods where it has a defined improvement purpose; exclude account, payment, health, support and free-text areas unless there is a compelling, properly assessed reason; and set short retention. If you cannot explain what the recordings show, who can watch them and why they are necessary, remove the tool until you can.
Fingerprinting needs evidence, not guesswork
You may not see a browser item named “fingerprint.” Look for supplier documentation, scripts that collect browser or device characteristics, fraud vendors, identity-resolution products and unusual calls involving canvas, WebGL, fonts, audio, browser APIs or detailed device configuration. These signs are prompts for questions, not conclusive proof by themselves.
Ask each supplier directly whether it performs fingerprinting, probabilistic device matching, cross-device recognition or identity resolution; which signals it collects; whether it stores or accesses information on the device; and whether it combines the result with your customer data or other clients’ data. Keep the answers with your audit evidence. The ICO states that PECR can apply to fingerprinting where it stores information or accesses information stored on a device.
Turn your inventory into a measurement-versus-privacy decision
Now assess each row by purpose, not by vendor label. Start from the default position that non-exempt storage or access needs valid consent before it is used. The ICO says non-exempt technologies must not be pre-enabled, and a customer continuing to browse is not a genuine substitute for a free choice.
Separate essential operation from useful marketing
Some functions may meet an exception. A basket session, load balancing, login security or a fraud-control measure can be essential in the right circumstances. But “useful to our business” is not the test. The strictly necessary exception is narrow: the technology must be essential to provide the service the person requested, or be the only reasonable and proportionate way to meet a legal requirement.
There are also newer exceptions that demand careful analysis. The statistical-purposes exception can support aggregate analytics used to improve your website or service, subject to its conditions, clear information and a simple free way to object. It is not a blanket pass for every analytics product. The ICO says it does not cover identifying, monitoring or profiling individual visitors, retaining individual-level information after aggregation, conversion data shared with advertising partners, or online advertising.
This produces a helpful practical split:
- Service delivery and security: assess whether a narrow exception genuinely applies, document why, and prevent the same identifier being reused for analytics or advertising.
- Aggregate website improvement: consider whether the statistical exception applies. Check that the output is aggregate, the provider acts only to improve your service, users receive clear information and an easy objection route, and the tool is not used for advertising or individual monitoring.
- Advertising, retargeting and campaign attribution: obtain consent before the relevant technology runs. Advertising measurement is part of the advertising purpose; it does not create a separate exemption.
- Session replay, detailed behavioural analysis, identity matching and fingerprinting: assume a high level of scrutiny. Define the purpose narrowly, minimise fields and retention, assess the personal-data implications and obtain consent where the activity is non-exempt.
One cookie or tag can have several purposes. If a supposedly essential login identifier is also used to recognise someone for personalised marketing, its mixed purpose can undermine the exception. Split the functions technically where possible. This gives you cleaner measurement, clearer notices and a much easier consent design.
Make the banner and notices match reality
Your audit is only useful if the customer experience reflects it. The ICO expects clear, comprehensive and understandable information covering the technologies, purposes, third parties and durations involved. Vague references to “trusted partners” are not enough when people need to understand who receives their information and why.
For consent-required categories, give people a clear choice before the tools run. A reject-all option should be as easy to use as accept-all, non-essential toggles should be off by default, and withdrawal should be as easy as granting consent. Test this technically after every major website, tag-manager, app, plugin or campaign change.
Then update the cookie information and privacy notice from the inventory, rather than writing them from memory. Use plain-language labels such as “measure how our ads lead to sales”, “understand which pages work well” and “help prevent fraudulent orders”, followed by the relevant supplier, data and duration. Link to the detailed list for people who want it.
Build the audit into normal marketing operations
The final step is governance, not a one-off spring clean. Set a review date based on how frequently you change your site. A fast-moving ecommerce business may need a lightweight monthly check and a fuller quarterly audit; a stable brochure site may need less often. Re-run the controlled visitor test before major campaigns and after installing any app, review widget, chat service, payment feature or agency tag.
Require a short tracking impact note before anyone adds code: business purpose, pages affected, supplier, data fields, recipients, retention, proposed PECR route, UK GDPR considerations and removal plan. No completed note, no live tag. Keep a named owner for every technology so abandoned campaigns do not leave permanent trackers behind.
Conclusion: keep the measurement you can explain
Effective digital transformation is not collecting everything because it might be useful one day. It is building a measurement setup that helps a small business make decisions while customers retain meaningful control.
Start with a fresh-browser test this week. List every cookie, pixel, script, storage key and third party that appears; challenge every item’s purpose; remove what you do not need; and make the remaining choices visible in your consent journey. Use the ICO’s audit guidance and its exceptions guidance as your working checklist. The result should be leaner tagging, more defensible reporting and a website customers can use with greater confidence.
