A technical privacy review should preserve the observed states, conditions, findings, and changes. Clear evidence helps future maintainers understand the configuration without turning a limited test into a sweeping compliance claim.
Before you begin
Agree on the review scope and approved requirements. Decide where evidence containing session data or personal information will be stored securely.
What to do
- Record website and page URLs, date, browser, region assumptions, login state, and the tools or configuration versions under review.
- Describe each test sequence, including initial visit, acceptance, rejection, and changed preferences. Keep observations separate from expected behavior.
- Save only the evidence needed to support a finding. Redact tokens and personal information before sharing screenshots, request logs, or browser exports.
- For each change, identify the responsible component, approved adjustment, and the checks repeated afterward. Note any affected reporting or customer functionality.
- List unresolved issues, third-party limits, and untested areas. Assign owners and a retest trigger, such as a new app or consent-manager update.
How to check the result
The record should let another reviewer understand the basis of each conclusion. State exactly what was observed rather than asserting that no tracking, privacy risk, or legal exposure can exist anywhere on the site.
If you need help
If evidence is incomplete, preserve the limitation and request the missing access or test conditions. Do not manufacture a pass from a failed request, unavailable browser, or test that never reached the relevant interaction.
Related help
- Create an inventory of website tracking and embedded tools
- Test what happens when a visitor accepts or rejects cookies
Official references
Reviewed October 31, 2026. Interfaces, vendor availability, and account features can change. Check your current account before making changes.
