SEO Audit in the First Meeting: How Agencies Use a Report Without Cold Outreach

Why the report belongs in a conversation

Many agencies know the pattern: check a company's website, generate a PDF report, send it unsolicited to the address from the contact page. It saves time, but it has two problems.

The first is trust. Google explicitly warns website owners about exactly this route: "Be wary of SEO firms and web consultants or agencies that email you out of the blue." As an example, Google quotes a spam email it receives itself: "Dear google.com, I visited your website and noticed that you are not listed in most of the major search engines" (Google Search Central: Do you need an SEO?, accessed 31 October 2026). The warning sits on the very page where Google explains how to choose an agency.

The second is the law. More on that below.

There is also a practical point: a technical report without explanation does not answer the reader's most important question, namely which of it matters for their business. You provide that translation in the conversation.

Conversation guide

The guide assumes that the prospect has asked for a meeting, for example through your website, a referral or after a talk, and that you have analysed their website beforehand.

Before the meeting

1. Review the analysis, do not just generate it. Read every finding you plan to show. A checking tool can be wrong, for example when bot protection blocked the fetch. A false finding in a first meeting costs credibility.
2. Pick three findings. Choose the ones that most clearly affect visitors or enquiries, not the ones with the loudest name.
3. Note the limits. What did the analysis not check? Rankings, search volume or backlinks are usually not part of a technical audit. Say so before the prospect asks.

In the meeting: five steps

1. Clarify goals. Which services should be found, in which region, and how does the prospect measure success: enquiries, applications, sales?
2. Show the overall picture. One sentence on the situation, without jargon. For example: "Google can read the site well, but the service pages barely differ from each other in the search results."
3. Explain three findings. For each: what you found, on which page, why it matters for visitors or search engines, and roughly what fixing it costs.
4. Name the limits. What was not checked and what cannot be predicted.
5. Agree the next step. Send the report, prepare a proposal, or explicitly none of these.

Questions you should be ready for

Google recommends that businesses interview an agency before hiring it and lists questions for that. Among them: "What kind of results do you expect to see, and in what timeframe?", "How do you measure your success?" and "Will you share with me all the changes you make to my site, and provide detailed information about your recommendations and the reasoning behind them?" (Google Search Central: Do you need an SEO?, accessed 31 October 2026). Prepare an honest answer to each. A prospect who knows that page may ask them.

Google also advises granting Search Console access for an audit as read-only: "only grant read access to Search Console (at this stage, don't grant them write access)". So in a first meeting, ask for read access at most, not for owner rights.

What goes into the report

Google describes what an audit should deliver: "An SEO audit should be about giving you realistic estimates of improvement, and an estimate of the work involved." And further: "If they guarantee you that their changes will give you first place in search results, find someone else." That gives a simple structure:

What does not belong in the report: guaranteed rankings, revenue forecasts without a data basis, and industry benchmarks whose origin you cannot name. Leave out findings you could not explain in the meeting. Ten supported points are easier to defend in conversation than eighty lines from a tool.

Watch the language. The reader is usually the owner or the head of marketing, not a developer. Write "page title" rather than "title tag", and where the technical term is needed, put it in brackets so that the web developer knows what is meant.

The proposal

The proposal follows from the action plan, not from a dream ranking. Three rules have proven themselves:

1. Describe the work, do not promise the outcome. "Rewrite page titles and meta descriptions for 25 service pages" can be checked. "Position 1 for your most important keyword" cannot, and it matches Google's warning above.
2. Packages in order. First what stops search engines from reading the site, then what improves its appearance in search results, then content. New text on pages that search engines are not allowed to read stays invisible until the block is lifted.
3. State validity and date. Websites change. A proposal based on an analysis from spring may no longer fit in autumn.

Whether the proposal sits inside the report or comes as a separate document is a matter of taste. Inside the report, finding and price sit side by side; as a separate document, it is easier to renegotiate.

The legal side: email marketing rules

Not legal advice. This section quotes or summarises the wording of laws and official guidance and does not replace review by a lawyer. Rules differ between countries, and which ones apply to a specific contact, for example across borders, is a question for legal counsel.

Germany: § 7 UWG

German law is strict here. § 7(2) no. 2 UWG lists as an unacceptable nuisance that is "always assumed": "advertising using an automated calling machine, a fax machine or electronic mail without the addressee's prior express consent" (quoted from the official English translation; only the German text is legally binding; UWG, English translation and § 7 UWG in German, both accessed 31 October 2026). Unlike the rule on phone calls, this provision does not distinguish between consumers and businesses. For calls, the Act requires "prior express consent" from a consumer, but only "at least the latter's presumed consent" from another market participant.

§ 7(3) UWG allows email advertising without consent only if four conditions are met together: you obtained the address from the customer "in connection with the sale of goods or services", you use it "for direct advertising of his or her own similar goods or services", the customer has not objected, and they are clearly advised of their right to object when the address is collected and each time it is used. For a prospect you have never worked with, this does not apply.

European Union: Article 13 of the ePrivacy Directive

The German rule implements Article 13 of Directive 2002/58/EC, as the UWG itself states. Article 13(1) says that electronic mail for direct marketing "may be allowed only in respect of subscribers or users who have given their prior consent". Article 13(2) contains the same exception for existing customers and "its own similar products or services". Article 13(5) applies paragraph 1 to subscribers who are natural persons; for others, Member States must ensure that their "legitimate interests" with regard to unsolicited communications "are sufficiently protected" (EUR-Lex: Directive 2002/58/EC, consolidated text, accessed 31 October 2026). That leaves room for national rules on emails to companies, so check the law of the recipient's country.

United Kingdom: PECR and ICO guidance

The ICO, the UK regulator, summarises the Privacy and Electronic Communications Regulations (PECR) as follows: "You must not send marketing emails or texts to individuals without specific consent", with a limited exception for previous customers, the "soft opt-in". On businesses, it says that "Sole traders and some partnerships are treated as individuals", while "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)." The ICO calls it good practice to keep a "do not email or text" list of businesses that object, and points to data protection rules for named employee addresses. The page also states that the guidance is under review following changes made by the Data (Use and Access) Act (ICO: Electronic mail marketing, accessed 31 October 2026).

United States: CAN-SPAM and the FTC guide

The FTC's compliance guide sets requirements for commercial email: "Despite its name, the CAN-SPAM Act doesn't apply just to bulk email", and "The law makes no exception for business-to-business email." Among the requirements: "Your message must include your valid physical postal address", you must disclose clearly and conspicuously that the message is an advertisement, and "You must honor a recipient's opt-out request within 10 business days." According to the guide, each separate email in violation is subject to penalties of up to 53,088 US dollars (FTC: CAN-SPAM Act: A Compliance Guide for Business, accessed 31 October 2026).

What follows in practice

The safe route, in every one of these countries, is the one where the prospect acts first:

• They ask for a meeting through your website, after a referral or after a talk.
• They explicitly ask for an assessment of their website.
• You show the report in the meeting and send it afterwards, because they asked for it.

Even where a cold email would be lawful, Google's warning above still applies: it is the approach prospects trust least. Mass mailing of reports to collected addresses is not part of this route.

Where Helferlain stands

Helferlain's SEO audit turns an analysis into an A4 report in the style of a consulting report: cover page, summary with an explanation of the overall score, action plan with effort, roadmap, detail cards, an optional proposal page and next steps. In the editor you can change headings and finding texts, leave out findings (with a note in the methodology) and add your agency with its logo as the sender.

For a first impression without signing up, there is the free website check for up to 15 pages. What the audit checks in detail is explained in Website check: the ten areas of a technical SEO audit; more on the product on the SEO audit page and under For agencies.