What Does a GDPR Compliance Checker Scan For on Websites?

What a GDPR Compliance Checker Scans For

A GDPR compliance checker loads your website in a real browser engine and records everything that happens on the client side, then reports on eight things it can see: every cookie and storage entry that is set (and crucially, whether non-essential cookies fire before consent), the design and timing of your cookie-consent banner, the presence and completeness of your privacy policy, personal-data collection points in forms, HTTPS/TLS and security-header configuration, the third-party services and trackers your pages call out to, whether user-rights channels are exposed, and hints about consent record-keeping. Everything a scanner reports is derived from what a browser observes during a crawl — not from your servers, contracts, or internal processes.

That is the summary an AI Overview will give you. Here is what it can't show you: which of those eight surfaces is a real fine risk versus cosmetic, exactly how the scanner decides a cookie was "set before consent," and — most importantly — the hard boundary between what the crawler can verify and what still needs a human. The diagram and comparison table below map that boundary so you know what a green scan actually proves.

What the scanner can see — and what stays dark

Cookie Name: _ga
Domain: .example.com
Purpose: Google Analytics - tracks user sessions
Duration: 2 years
Type: Analytics/Third-party
Consent Required: YES
Status: ⚠️ Set before consent obtained

5. Website Technology and Security

What They Verify:

Technical security and infrastructure compliance:

• SSL/TLS encryption: HTTPS implementation across entire site
• Secure transmission: Encryption for data in transit
• Mixed content: HTTP resources loaded on HTTPS pages
• Security headers: Content Security Policy, X-Frame-Options, etc.
• Cookie security flags: Secure and HttpOnly cookie attributes
• Login security: Protection of authentication mechanisms

SSL Certificate Validation:

Scanners check:

• Valid SSL certificate (not expired)
• Strong encryption (TLS 1.2 or higher)
• Complete HTTPS coverage (no HTTP pages)
• Secure cookie transmission (Secure flag set)
• No mixed content warnings

6. Third-Party Services and Data Processors

What They Detect:

Identification of external services that process visitor data:

• Analytics platforms: Google Analytics, Adobe Analytics, Matomo
• Advertising networks: Google Ads, Facebook Pixel, programmatic ad platforms
• Social media widgets: Facebook Like, Twitter/X embed, LinkedIn buttons
• Chat/support tools: Intercom, Drift, LiveChat
• CRM and marketing automation: HubSpot, Mailchimp, Salesforce
• Content delivery: CDNs and third-party hosting
• Payment processors: Stripe, PayPal, payment gateways

Data Transfer Assessment:

For each third-party service, scanners check:

• Whether it's disclosed in privacy policy
• Legal basis for data sharing
• Data transfer mechanisms (if outside EU/EEA)
• Presence of data processing agreements (conceptual check)
• Cookie consent requirements

High-Risk Third Parties:

Services requiring particular attention:

• US-based processors (requires adequate transfer mechanisms post-Schrems II)
• Advertising and tracking services
• Social media platforms with broad data collection
• Services with opaque privacy practices

7. User Rights Implementation

What They Look For:

Mechanisms enabling GDPR user rights:

• Access requests: Process for users to obtain their data
• Data portability: Ability to download data in machine-readable format
• Deletion requests: "Right to be forgotten" implementation
• Rectification: Ability to correct inaccurate data
• Objection: Process to object to processing
• Restriction: Mechanisms to restrict processing
• Contact methods: Clear channels for exercising rights

Common Findings:

• No documented process for handling rights requests
• Missing contact information for rights exercise
• Inadequate response timeframes (GDPR requires 1 month)
• No self-service data export functionality

8. Consent Records and Documentation

What They Assess:

While scanners cannot directly access backend systems, they check for:

• Consent record keeping: Whether privacy policy mentions consent logging
• Proof of consent: Systems to demonstrate valid consent was obtained
• Consent details: Timestamp, IP address, consent version tracking
• Consent withdrawal tracking: Records of withdrawal requests
• Audit trail: Documentation systems for compliance verification

GDPR Requirement:

Organizations must maintain detailed records of consent for at least 5 years to meet audit requirements and protect against regulatory challenges.

Scanner Capabilities and Technology

Automated Crawling

GDPR compliance scanners use web crawling technology to:

1. Discover pages: Systematically navigate website structure
2. Execute JavaScript: Render dynamic content and single-page applications
3. Trigger consent flows: Interact with cookie banners
4. Analyze network traffic: Identify all cookies and third-party requests
5. Extract policy text: Parse privacy policies and legal documents
6. Generate reports: Compile findings into actionable compliance reports

Detection Techniques

Cookie Detection:

// Scanners analyze cookies from multiple sources
document.cookie                    // JavaScript cookies
HTTP Cookie headers                // Server-set cookies
Third-party request headers        // External service cookies
LocalStorage/SessionStorage        // Web storage APIs
IndexedDB                          // Client-side databases

Third-Party Identification:

Scanners analyze network requests to identify:

• External domain requests
• CDN resources
• API calls to third-party services
• Embedded widgets and iframes
• Tracking pixels and beacons

Reporting and Visualization

Modern scanners provide:

• Risk scoring: Overall compliance score and risk level
• Category breakdown: Issues organized by type (cookies, privacy policy, security)
• Severity classification: Critical, high, medium, low priority findings
• Remediation guidance: Specific recommendations for each issue
• Comparison over time: Track compliance improvements
• Executive summaries: High-level overviews for non-technical stakeholders

Scanner-Verifiable vs. Human-Review-Only: The Compliance Boundary

The single most useful thing to internalize about GDPR scanners is where they stop. Everything a crawler reports comes from a browser session; everything that lives in your servers, contracts, or filing cabinet is invisible to it. This table is the boundary the hero diagram sketches, made concrete — and the "Which handles it" column tells you who owns each item.

The pattern is clear: scanners are excellent at the observable, client-side column and blind to the organisational one. A green scan removes the violations regulators find in the first five minutes of an audit; it does nothing for the ones they find in the next five hours.

What GDPR Scanners Cannot Detect

Limitations to Understand

Automated scanners have important limitations:

1. Internal processes: Cannot assess data processing procedures, employee training, or data governance frameworks
2. Backend systems: No visibility into databases, CRM systems, or backend data handling
3. Legal agreements: Cannot verify data processing agreements with third parties
4. Context and intent: May misclassify cookies or fail to understand business-specific contexts
5. New or uncommon technologies: May miss cutting-edge tracking methods not in their databases
6. Complete website coverage: May not crawl authentication-required pages or complex workflows

Manual Review Required

Critical compliance areas requiring human assessment:

• Data processing impact assessments (DPIAs)
• Legitimate interest assessments (LIAs)
• Data processing agreements with vendors
• Data breach response procedures
• Privacy by design implementation
• Cross-border data transfer mechanisms
• Record of processing activities (ROPA)
• Employee privacy training programs
• Vendor due diligence processes

Using Scanner Results Effectively

Prioritization Framework

Address findings in order of risk and impact:

Critical (Address Immediately):

• Cookies set before consent
• Missing or inadequate privacy policy
• No SSL/TLS encryption
• Undisclosed third-party data sharing

High (Address Soon):

• Inadequate consent mechanisms
• Missing user rights implementation
• Unclear data retention policies
• Weak security configurations

Medium (Plan Remediation):

• Privacy policy language clarity
• Cookie categorization improvements
• Documentation enhancements
• Consent renewal mechanisms

Low (Continuous Improvement):

• Minor policy updates
• Additional transparency measures
• User experience enhancements
• Best practice adoptions

Remediation Process

1. Document current state: Baseline scan results
2. Assign ownership: Designate responsible parties for each finding
3. Develop action plan: Timeline and resources for remediation
4. Implement fixes: Technical and policy changes
5. Validate corrections: Re-scan to verify improvements
6. Monitor continuously: Regular scanning for ongoing compliance

Choosing a GDPR Compliance Scanner

Evaluation Criteria

Select scanners based on:

• Comprehensive coverage: Cookies, privacy policies, third parties, security
• Accuracy: Low false positive/negative rates
• Database quality: Up-to-date cookie and tracker identification
• Reporting depth: Actionable findings with remediation guidance
• Scanning frequency: Support for continuous monitoring
• Integration capabilities: API access, CI/CD integration
• Cost and licensing: Pricing aligned with organization size
• Support and updates: Vendor responsiveness and regular improvements

Leading Solutions (2026)

Popular GDPR compliance scanners include:

• Cookiebot: Cookie compliance and consent management
• OneTrust: Enterprise privacy management platform
• CookieYes: Cookie scanner and consent solution
• Usercentrics: Consent management and compliance
• Enzuzo: Privacy compliance scanner
• 2GDPR: Free basic website scanning
• Our GDPR Checker: Quick compliance assessment at /tools/compliance/gdpr-checker

Conclusion

GDPR compliance checkers scan websites for cookies and tracking technologies, consent mechanisms, privacy policy adequacy, data collection practices, website security, third-party services, user rights implementation, and documentation practices. These automated tools provide valuable insights into technical compliance issues and common GDPR violations.

However, automated scanning represents only part of a comprehensive GDPR compliance program. Scanners identify technical issues visible through web crawling but cannot assess internal processes, legal agreements, data governance frameworks, or business-specific contexts that significantly impact overall compliance.

Use GDPR compliance scanners as an initial assessment tool and regular monitoring mechanism, but supplement automated scanning with:

• Legal counsel review of policies and practices
• Data protection impact assessments
• Vendor contract reviews
• Employee training programs
• Privacy by design implementation
• Ongoing privacy governance

In 2026, with regulators actively auditing companies across all industries and enforcement intensifying, regular GDPR compliance scanning helps identify and remediate technical violations before they result in regulatory action or reputational damage.

Our GDPR Checker tool provides quick compliance scanning to identify common issues with cookies, consent, and privacy policies - helping you understand your compliance status and prioritize improvements.