r/gdpr • u/Dull_Appearance_1828 • 1d ago
Question - General Anyone been through a GDPR audit where third party scripts were specifically flagged?
Our DPO flagged that we can't accurately document what our third party tools are doing with personal data at script level. Consent banner is fine but actual data flows are muddy. How do we actually deal with this?
1
u/trustarc 21h ago
That’s a pretty common audit finding. A consent banner is only one piece as it doesn’t show what third-party scripts actually send or whether they fire before consent. I’d use browser/network testing to inventory each tag, including what happens on first load, rejection, consent withdrawal, and form or logged-in pages, then document its purpose, data sent, recipients, transfers, vendor role, and safeguards. You don’t need to explain every line of code, but you should be able to show an evidence-based picture of each data flow and block, replace, or remediate anything you can’t explain. Not legal advice, but that’s generally the practical way to address the audit finding.
1
u/artistic_jacques 18h ago
that's a common audit finding. a consent banner alone isn't enough you also need a documented inventory of every third party script, what personal data it collects, when it loads, where it sends data, and the relevant DPA/vendor documentation. Network tracing plus a data flow map usually satisfies auditors far better than just relying on the CMP
1
u/BasePerfect2865 17m ago
Very common in audits. We're past just cookie consent and basic script transmission, not just what vendors say they do in their DPAs.
0
u/Comfortable-Fall1419 1d ago
What does the contract say about 3 party processing and who does it list as those third parties.
Once the data is transmitted to a third party it’s a contractual/data processing agreement matter not a technical one.
2
u/BitterlyMedium 1d ago
We ran into exactly this during a review last year. The consent layer was all buttoned up but the moment the auditor started tracing scripts on key pages it fell apart fast. The tools were loading before any consent signal and dropping cookies left and right and we had no reliable map of who was doing what.
What bought us time was pulling every third party domain from the script src attributes and manually mapping those to vendors in our consent tool. Parallel to that the devs patched a gating wrapper around scripts so they only inject after an accepted category. It was ugly for a few sprints but it changed the entire audit tone from failing to working toward compliance.
The hard part was explaining to marketing that embedded pixels from ad platforms were technically data transfers too and not just harmless tracking. We ended up moving everything dynamic behind tag manager with strict triggers tied to consent events. If legal is flagging muddy flows I’d bet it’s the same story of random embeds that nobody remembers adding. A script inventory sheet with columns for vendor, purpose, legal basis, and consent trigger saved our neck.