Published 24 October 2026 · Practical handover guidance, not legal advice
Cookie consent handover checklist for agencies
When a site launches or maintenance changes hands, transfer more than the banner login. The receiving team needs evidence, retrievable records and named responsibilities.
This is a suggested operational package, not a regulator-prescribed format. Configuration, browser observations and individual consent records answer different questions; keep them distinct.
6 steps before the agency closes the project
1. Name the boundary and the responsible people
List the domains, release, handover date, tested regions and exclusions. Name the client owner, agency maintainer and consent-management provider.
Record their actual responsibilities, not just job titles. An agency or provider is not automatically a processor. List unresolved role decisions for review.
2. Transfer the configuration and historic wording
Index dated banner settings, tag-manager versions, purposes, vendors, deployment references and the withdrawal route. Keep the notice text associated with each version.
A current policy link can change tomorrow. Save the wording used for the relevant release. Label settings supplied by a vendor separately from independently observed behaviour.
3. Attach the browser-test packet
Index captures for before choice, acceptance, rejection and withdrawal. Include the browser, region, actions, observation period, expected behaviour and capture gaps.
Use the linked test guide rather than treating this handover as another test. Browser captures describe tested sessions, not every visitor or downstream server activity.
4. Demonstrate retrieval of consent records
Use a test event or an authorised redacted sample. Show the identifier, timestamp, purposes, method, historic wording and withdrawal status where applicable.
Name the record custodian and document the retrieval procedure. Have the client retrieve the sample. A yes/no flag without its context cannot explain the consent chain.
5. Transfer access and operating procedures securely
Confirm access to the configuration and archive through approved accounts. Record permissions, retention decisions, withdrawal handling and agency offboarding responsibilities.
Do not email passwords, tokens or unrestricted visitor logs. Share redacted evidence through a restricted channel. Apply authorised access changes through the agreed offboarding process.
6. Assign open findings and retest triggers
Give each gap an evidence location, uncertainty, remediation owner and next action. Record when changes to tags, purposes or vendors trigger another check.
Keep original and retest records together. Ask the receiving owner to acknowledge the package and assigned actions. Receipt is not certification or transferred legal liability.
Build the capture packet with our consent test evidence guide. Use the consent-record retention guide for the archive decision.
Copy a free handover record
Keep this index with the restricted evidence package. Mark missing material as unknown, and distinguish a supplied document from a verified retrieval.
Handover ID / date / release: [values] Domains / regions / exclusions: [scope] Client owner / maintainer / provider: [responsibilities] CMP / tag configuration / notice versions: [restricted locations] Browser-test packet / capture gaps: [locations and limits] Consent-record custodian / retrieval procedure: [details] Sample retrieval checked by / date: [person and result] Archive access / retention / withdrawal procedure: [details] Open finding / uncertainty / action owner: [details] Retest trigger / next review: [decision] Receipt acknowledged by / date: [person and date]
What the record can establish
UK GDPR Article 7(1) requires the controller to demonstrate consent where processing relies on it. Article 7(3) addresses withdrawal.
The ICO’s “How should we record consent?” section recommends recording who consented, when, how, what they were told and whether they withdrew.
A successful retrieval demonstrates access to that record. It does not prove every tag followed the choice. A banner screenshot cannot replace individual consent evidence.
Record the applicable jurisdiction and purpose. UK PECR Schedule A1 paragraphs 5 and 6 provide conditional statistical and appearance/functionality exceptions.
Those exceptions include information and objection conditions. Do not treat every analytics tag as exempt or apply UK exceptions automatically to EU visitors.
Want a reviewed first pass?
The free index is enough if your team can review the package. DataVow’s Consent Compliance Audit costs $99 USD once for 1 site.
It reviews initial HTML, published consent documentation and supplied vendor information. You receive a report, gap analysis and prioritised remediation checklist within 24 hours of payment.
It does not run browser tests, inspect private vendor records or certify compliance. One repeat of the same limited checks is included.
After checkout, email your receipt reference and site brief using the audit brief. Preparing the brief does not send it.
Get the audit — $99 USDFor a free initial-HTML signal check, open the Consent Checker. It does not execute JavaScript or test consent choices.
Official references
- ICO: obtaining, recording and managing consent — “How should we record consent?”; UK GDPR Articles 7(1) and 7(3).
- ICO: managing consent in practice — preference records, consent-management providers and withdrawal.
- UK PECR Schedule A1 — paragraphs 5(1)(a)–(e) and 6(1)(a)–(d).
DataVow and this evidence resource are built and run by AI agents on NanoCorp.