Home Verified permalink · Latest public audit

lloydsbank.com

UK compliance audit.

Scan complete

Compliance Score

How the score was calculated

Starting score: 100
2 critical findings: −50
1 high finding: −15
1 medium finding: −5
Final score: 30

AI Analysis

The audit of Lloyd's Bank website reveals partial UK GDPR and PECR compliance, with a score of 30/100. Key issues include an insufficient cookie consent mechanism that fails to meet GDPR standards, lack of detailed explanations regarding the functions of cookies, and seven checks being skipped due to unmet conditions related to specific JavaScript variables (s_cc and utag_main), indicating areas requiring immediate attention for full compliance.

Fix these first

3 priorities

01
CRITICALcheck_initial_cookies
Found 2 non-essential cookie(s): [s_cc utag_main]
02
CRITICALcheck_cookies_after_reject
Found 2 non-essential cookie(s): [s_sq s_cc] (after clicking: <button.main> text='Reject all')
03
HIGHwcag_aa_scan
Found 1 accessibility violation(s): 1 critical, 0 serious, 0 moderate, 0 minor

Report Details

Playbook: UK Cookie Compliance
Domain: lloydsbank.com
Started At: 2 Jan 2026, 13:50
Duration: 4m 3s
Total Checks: 37
Report ID: z_0ZIzTQeKKV

Check Results

Data Capture

3 checks All passed

capture_html_initial

INFO

Captured HTML (408971 bytes) from https://www.lloydsbank.com/

Captured HTML:

View rendered

screenshot_initial

INFO

Screenshot saved: https://smesolutions.uk/artifacts/artifacts/f8018eaa-9109-48e9-a218-bf2b2ab4921a/screenshots/initial_state.png

Screenshot Evidence:

Click to view full size

capture_cookies_initial

INFO

Captured 15 cookies

Captured Cookies:

View full list

Pre-Consent Cookies

1 check1 failed

check_initial_cookies

CRITICAL-25

Found 2 non-essential cookie(s): [s_cc utag_main]

s_cc

utag_main

Non-Essential Cookies:

s_ccanalyticsSession

"This cookie matches known analytics/tracking patterns"

utag_mainanalytics12mo

": The cookie "utag_main" is typically used for tracking user behavior and collecting statistics, which falls under the analytics category."

PECR Regulation 6(1)

Cookies (except strictly necessary) require user consent BEFORE being set

View guidance

Cookie Consent Banner

6 checks All passed

find_banner

INFO

Found consent banner via heuristic (height: 314px)

PECR Regulation 6(2)

Clear and comprehensive information must be provided about cookie use

View guidance

find_cookie_banner

INFO

Value true == true: true

verify_banner_visible

INFO

Element visibility is true as expected

screenshot_banner

INFO

Screenshot saved: https://smesolutions.uk/artifacts/artifacts/f8018eaa-9109-48e9-a218-bf2b2ab4921a/screenshots/cookie_banner.png

Screenshot Evidence:

Click to view full size

extract_banner_text

Extracted 101 words

check_banner_content

LOW

Value 101 >= 10: true

PECR Regulation 6(2)(a)

Cookie notice must provide clear, comprehensive information about purposes

View guidance

Cookie Controls

4 checks All passed

find_reject_button_semantic

INFO

Found reject button: <button.main> text='Reject all'

find_accept_button_semantic

INFO

Found accept button: <button#accept.main> text='Accept all'

find_reject_button_any

CRITICAL

Value 1 == 1: true

find_accept_button_any

Value 1 == 1: true

Dark Pattern Detection

1 check All passed

compare_button_prominence

HIGH

Buttons have similar prominence

EDPB Guidelines 03/2022 on Dark Patterns

Reject option must have equal prominence to accept - asymmetric design is a deceptive pattern

View guidance

AI Dark Pattern Analysis

2 checks All passed

check_dark_patterns_vision

HIGH

No specific dark patterns identified in cookie banner

EDPB Guidelines 03/2022 on Dark Patterns

Visual deceptive patterns including color manipulation and hidden controls are prohibited

View guidance

check_deceptive_buttons

HIGH

Button labels are clear and not deceptive

EDPB Guidelines 03/2022 on Dark Patterns

Button labels must accurately reflect their function without ambiguity or deception

View guidance

AI Content Analysis

3 checks1 failed

check_banner_quality_llm

MEDIUM-5

Banner content is not GDPR compliant

Cookie banner does not meet GDPR compliance requirements

incomplete explanation of what cookies do

lack of mention about third-party data sharing

unclear how to change consent after initial selection

Banner Text Analyzed:

"Cookies Consent We have to collect some data when you use this website so it works and is secure. We'd also like your consent to collect data on how you use our site. This helps us decide which of our products, services and offers may be relevant for you. It also helps us tailor and measure how effective our ads are on other websites, social media, apps and devices, like Smart TVs. Select 'Accept all' to agree or 'Reject all' to opt out. You can change your mind, or find out more, by visiting..."

PECR Regulation 6(2)(a)

Cookie notices must provide clear, comprehensive information about purposes

View guidance

check_language_consistency

LOW

Banner language (en) matches page language

PECR Regulation 6(2)(a)

Information must be provided in a language users can understand

check_cookie_purposes

MEDIUM

No cookies available for purpose matching

PECR Regulation 6(2)(a)

All cookies used must be disclosed and explained in the notice

View guidance

AI Accessibility Analysis

1 check All passed

check_visual_accessibility

MEDIUM

Banner meets visual accessibility standards (score: 50/100)

None found.

Equality Act 2010

Cookie banners must be accessible to users with disabilities including visual impairments

View guidance

Consent Verification

4 checks1 failed

click_reject_button

Clicked element <button.main> text='Reject all'

wait_after_reject

Waited 2000ms

check_cookies_after_reject

CRITICAL-25

Found 2 non-essential cookie(s): [s_sq s_cc] (after clicking: <button.main> text='Reject all')

s_sq

s_cc

Button clicked to reject cookies: <button.main> text='Reject all'

Non-Essential Cookies:

s_sqanalyticsSession

"This cookie matches known analytics/tracking patterns"

s_ccanalyticsSession

"This cookie matches known analytics/tracking patterns"

UK GDPR Article 7(3), PECR Regulation 6

When consent is withdrawn, cookies must be removed - continued tracking is unlawful

View guidance

verify_banner_dismissed

LOW

Element is no longer accessible (dismissed/removed from DOM)

Accessibility

1 check1 failed

wcag_aa_scan

HIGH-15

Found 1 accessibility violation(s): 1 critical, 0 serious, 0 moderate, 0 minor

Critical accessibility barrier: Elements must only use supported ARIA attributes. This violation affects users who rely on assistive technologies. 1 element(s) affected.

Website has 1 critical and 0 serious WCAG AA violations that significantly impact users with disabilities. These issues may prevent screen reader users, keyboard-only users, or users with visual impairments from accessing the cookie consent interface.

Accessibility Issues:

Elements must only use supported ARIA attributescritical1 element

Ensures an element's role supports its ARIA attributes

Affected elements :

<div class="yxt-AutoComplete-wrapper js-yxt-AutoComplete-wrapper" aria-expanded="false">
  <span class="yxt-AutoComplete-resultsCount sr-only" aria-li...

How to fix

Public Sector Bodies Accessibility Regulations 2018, Equality Act 2010

UK websites must meet WCAG 2.1 Level AA standards; failure may constitute disability discrimination

View guidance