How to Check if Your Startup Website Is GDPR and ICO Compliant (Using Privacy Probe)

The legal framework every UK startup website operates under

If your website uses analytics, cookies, or marketing tracking, it operates under:

• UK General Data Protection Regulation (UK GDPR)
• Privacy and Electronic Communications Regulations (PECR)
• For EU visitors, EU GDPR and the ePrivacy Directive

PECR specifically regulates cookies and tracking technologies in the UK.

The law states that organisations must not store or access information on a user’s device unless:

• The cookie is strictly necessary, or
• The user has given consent

Source: Privacy and Electronic Communications Regulations 2003.

The UK Information Commissioner’s Office explains this clearly:

“Similarly, you cannot set non-essential cookies on your website’s homepage before the user has consented to them.”

Source: ICO Cookies and Similar Technologies Guidance.

This applies to startups as much as large companies.

Why this affects most startup websites

Most modern startup websites use tools such as:

• Google Analytics
• LinkedIn Insight Tag
• Meta Pixel
• HubSpot
• Intercom
• Hotjar

These tools store identifiers or access information on the user’s device. Under PECR, this activity requires consent.

Source: ICO Cookies Guidance.

Under UK GDPR, these identifiers can also qualify as personal data.

Source: UK GDPR legislation.

Why a cookie banner alone does not guarantee compliance

Many founders assume installing a cookie banner solves the problem. Legally, this is not sufficient.

Consent must be obtained before tracking activates.

The European Data Protection Board states that consent must be obtained prior to processing and cannot be inferred from silence or inactivity.

Source: EDPB Guidelines 05/2020 on Consent.

If analytics loads before consent, the implementation may not comply with PECR. This is a technical issue, not just a legal one.

Why founders often don’t realise this is happening

Startup websites evolve continuously. Tracking can be introduced through:

• Tag managers
• Marketing integrations
• Developer scripts
• Third-party embeds

The ICO makes clear that organisations are responsible for all tracking technologies operating on their website.

Source: ICO Cookies Guidance.

In real startup environments, tracking may be active without founders being aware.

How to check if your website is compliant

If you are reading this, you may be asking:

• Is my website compliant with ICO cookie rules?
• Is Google Analytics running before consent?
• Does my cookie banner actually block tracking?
• Would my website pass a compliance review?

These questions require technical verification, not assumptions.

Manual method: checking using browser tools

You can check cookies using browser developer tools:

Chrome → Developer Tools → Application → Cookies

Refresh the page without accepting cookies. If analytics cookies appear, tracking has already occurred.

Common examples include:

• _ga
• _gid
• _fbp

This method works but requires technical knowledge.

Automated method: using Privacy Probe

Privacy Probe was built to help founders see tracking behaviour clearly.

It scans your website as a real visitor and identifies:

• Cookies set before consent
• Tracking technologies in use
• Whether tracking activates before user consent

This helps founders verify whether website behaviour aligns with consent requirements under PECR and UK GDPR.

Privacy Probe.

Why this matters beyond regulatory compliance

Privacy compliance affects business operations. It frequently arises during:

• Enterprise customer procurement
• Security questionnaires
• Investor due diligence
• Acquisition reviews

Investors and enterprise customers increasingly expect companies to understand their data practices. This includes website tracking.

Source: ICO Accountability Principle.

Real enforcement examples

Regulators actively enforce cookie compliance. The ICO has issued enforcement actions requiring organisations to fix cookie practices.

Source: ICO Enforcement Actions.

European regulators have also issued major fines. For example, Amazon was fined €746 million for GDPR violations involving advertising targeting and data processing.

Source: Luxembourg National Commission for Data Protection.

This demonstrates that tracking compliance is taken seriously by regulators.

Compliance checklist for startup founders

You should be able to answer:

• Does analytics wait for consent?
• Do marketing pixels wait for consent?
• Do you know what tracking technologies exist?
• Does your privacy policy reflect actual tracking behaviour?

If you do not know, the first step is visibility.

FAQ

Do startup websites need cookie consent?

Yes, if they use non-essential cookies.

Source: PECR legislation.

Is Google Analytics allowed under UK GDPR?

Yes, but consent is required.

Source: ICO Guidance.

Can I rely on a cookie banner alone?

No. Tracking must be blocked until consent.

Source: EDPB Consent Guidelines.

How do I check compliance?

Manual inspection or scanning tools such as Privacy Probe can help provide visibility.

Final takeaway

Compliance does not begin with a cookie banner. It begins with understanding what your website actually does.

Most startup websites are not intentionally non-compliant. They operate without full visibility into their tracking infrastructure.

Understanding that behaviour is the first step in managing privacy risk professionally.

Primary sources and regulatory references

• UK Information Commissioner’s Office Cookies Guidance
• Privacy and Electronic Communications Regulations
• UK GDPR
• European Data Protection Board Consent Guidelines
• ICO Enforcement Actions
• Luxembourg National Commission for Data Protection Amazon Fine
• Privacy Probe