Scan any website for GDPR issues in under a minute. Grades cookie consent, third-party trackers, privacy policy coverage and controller contact details.
Enter a URL and this GDPR compliance checker fetches the page, inspects what it finds, and returns a graded report on four things a supervisory authority or an annoyed visitor would look at first: whether there is a cookie consent mechanism, whether third-party tracking scripts are present in the page source, whether a privacy policy exists and covers the topics the GDPR requires, and whether the identity and contact details of the organisation behind the site are actually published.
It is a triage tool. It scans publicly accessible pages only, it takes about 30–60 seconds, and it produces an overall score out of 100 with a letter grade, per-component grades, an itemised issue list with severity levels, and a JSON export you can attach to a ticket. It is aimed at web developers, marketing teams and small-business owners who need to know quickly whether a site is in obvious trouble — not at replacing a data protection audit.
Being precise about the method matters, because a scanner that overstates what it saw is worse than no scanner. This tool retrieves the HTML of the page you supply and, where it can find one, the linked privacy policy page. It then analyses that markup and the response headers.
The overall score is a weighted blend: cookie consent, privacy policy and tracking each contribute 25%, with contact information and user-rights signals making up the remainder.
This scanner reads the page as delivered; it does not run a full browser, click your banner, or watch what happens afterwards. That has three consequences worth stating plainly:
Treat a good grade as “no obvious problems in the markup”, not as a clean bill of health. Treat a bad grade as a reliable signal that something needs fixing.
Understanding why each item is scored makes the report far more useful than the number alone.
Consent must be a genuine choice. Under Article 4(11) consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action. Article 7(3) requires that withdrawing consent be as easy as giving it. This is the legal root of the reject-all check: a banner offering a prominent “Accept all” and burying refusal two clicks deep does not represent a free choice, and European supervisory authorities have repeatedly said so. Granular controls matter for the same reason — consent is specific to a purpose, so bundling analytics and advertising behind one button is a problem.
Cookie placement is governed by the ePrivacy Directive as well. The requirement to obtain consent before storing or accessing information on a user’s device comes from Article 5(3) of the ePrivacy Directive, as implemented in national law, with the GDPR supplying the standard for what valid consent looks like. Strictly necessary cookies are exempt; analytics and advertising cookies generally are not.
Privacy policy content is prescribed, not free-form. Articles 13 and 14 list what must be told to a data subject: the identity and contact details of the controller and any DPO, the purposes and legal basis for each processing operation, recipients, any transfer to a third country and the safeguard relied on, the retention period or the criteria used to set it, the data subject rights under Articles 15 to 22, the right to withdraw consent, and the right to lodge a complaint with a supervisory authority. The policy component scores against exactly this list.
Transfers outside the EEA need a basis. Chapter V allows transfers to countries covered by an adequacy decision under Article 45, or otherwise under safeguards such as Standard Contractual Clauses or Binding Corporate Rules under Article 46. Any US-based analytics or advertising vendor in your tracker list is a transfer question as well as a consent question.
| Finding | Typical fix |
|---|---|
| No consent banner detected | Deploy a consent management platform, or remove non-essential cookies entirely so no banner is needed |
| No reject-all option | Add a refuse button with equal visual weight to accept, on the first layer of the banner |
| No granular consent | Split consent by purpose category and default every non-essential category to off |
| Trackers present in source | Move tag firing behind the consent signal; verify in the browser network tab that nothing loads before a choice is made |
| Privacy policy not found | Publish a policy and link it from the site footer on every page |
| Missing legal basis or retention section | Add the Article 13 disclosures per processing purpose rather than as generic boilerplate |
| No controller identity or contact route | Publish the legal entity name, postal address and a monitored contact address; add DPO details if one is appointed |
No. The GDPR governs your entire processing of personal data — internal systems, employee records, vendor contracts, retention schedules, breach procedures — and a website scan touches only the public surface. A high grade means the public-facing signals look right. Compliance is a broader question and this tool is an informational aid, not legal advice.
Almost always because the banner is rendered by JavaScript after page load, and this scanner analyses the HTML as delivered rather than executing scripts. It is a known limitation. Verify manually before treating that finding as real.
Not definitively. It reports which known trackers appear in the page source, which is a strong risk indicator, but confirming the actual firing order requires a real browser session. Open your site in a private window with the network tab recording and watch what loads before you touch the banner.
It scans the URL you supply and, if it can locate one, the linked privacy policy page. It does not crawl your whole site. Run it against several important templates — homepage, a product page, checkout — if tracking differs across them.
In most EEA member states, yes. The ePrivacy exemption covers cookies strictly necessary to deliver a service the user requested, and general-purpose analytics does not qualify in most national interpretations. Some authorities allow a narrow exemption for privacy-preserving first-party analytics under specific conditions; check the guidance of the supervisory authority that regulates you.
If you process personal data of people in the EEA, Articles 13 and 14 require that specified information be provided to them, and a published privacy notice is the standard way of doing it. Copying someone else’s policy is a common and bad idea, because it will describe processing you do not do and omit processing you do.
The scan runs server-side because it must fetch the target site, and results are returned with caching disabled rather than persisted for you to retrieve later. Export the JSON if you want a record.
In order: publish or repair the privacy policy, stop non-essential tags from loading before consent, add a genuine reject-all, then add granular categories. For a closer look at what individual cookies are doing, use the cookie analyzer; to rebuild the policy itself, the privacy policy generator produces a GDPR, CCPA and COPPA-aware draft.
The paperwork behind it. Work out whether you are a controller or a processor, record your processing activities under Article 30, set retention periods and check whether a DPIA is triggered — the GDPR role and retention mapper walks through all of that. If you want the security side of the same review, the security headers analyzer checks the transport and browser-policy headers this scan does not grade.
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law that governs how organizations collect, process, store, and share personal data of EU and EEA residents. A GDPR compliance check evaluates an organization's data processing practices against the regulation's requirements, identifying gaps that could result in penalties of up to EUR 20 million or 4% of global annual revenue.
GDPR applies to any organization worldwide that processes personal data of EU residents, regardless of where the organization is based. This extraterritorial scope means that U.S. companies, Asian businesses, and any entity with EU customers or website visitors must comply.
| Principle | Article | Requirement |
|---|---|---|
| Lawfulness, fairness, transparency | Art. 5(1)(a) | Process data lawfully with a valid legal basis and transparent privacy notices |
| Purpose limitation | Art. 5(1)(b) | Collect data for specified, explicit, legitimate purposes only |
| Data minimization | Art. 5(1)(c) | Collect only the data that is adequate, relevant, and necessary |
| Accuracy | Art. 5(1)(d) | Keep personal data accurate and up to date |
| Storage limitation | Art. 5(1)(e) | Retain data no longer than necessary for its purpose |
| Integrity and confidentiality | Art. 5(1)(f) | Protect data with appropriate security measures |
| Accountability | Art. 5(2) | Demonstrate compliance with all principles |
General Data Protection Regulation (GDPR) is EU law regulating personal data processing. Applies to: EU organizations, non-EU organizations processing EU residents data. Key requirements: lawful basis for processing, consent for non-essential cookies, privacy policy, data subject rights (access, deletion, portability), breach notification (72 hours), Data Protection Officer (if required), data processing agreements. Penalties: up to 4% global revenue or €20M. Enforcement: EU Data Protection Authorities. Applies since May 2018.
GDPR privacy policy must include: 1) Data controller identity and contact. 2) Data Protection Officer contact (if required). 3) Processing purposes and legal basis. 4) Data categories collected. 5) Recipients/transfers (third parties, international). 6) Retention periods. 7) Data subject rights (access, deletion, portability, objection). 8) Right to withdraw consent. 9) Right to lodge complaint with supervisory authority. 10) Automated decision-making disclosure. Must be: clear, concise, accessible, free. Update when processing changes.
GDPR cookie consent requirements: 1) Explicit consent before non-essential cookies. 2) Pre-ticked boxes invalid. 3) Granular options (analytics, marketing separately). 4) Easy to withdraw consent. 5) No cookie walls (blocking access). 6) Clear information (cookie purpose, duration, third parties). 7) Consent proof/records. Essential cookies (session, security) do not need consent. Cookie banner must: appear before loading cookies, allow rejection, be easy to understand. Validate: cookies not loaded before consent, withdrawal functional.
Eight data subject rights: 1) Right to be informed (privacy policy). 2) Right of access (data copy, SAR response within 30 days). 3) Right to rectification (correct inaccurate data). 4) Right to erasure (deletion, "right to be forgotten"). 5) Right to restrict processing (limit use). 6) Right to data portability (structured export). 7) Right to object (opt-out). 8) Rights related to automated decision-making (human review). Organizations must: verify identity, respond within 30 days, free (unless excessive).
Six lawful bases under GDPR: 1) Consent - explicit, informed, freely given (used for marketing). 2) Contract - necessary for contract performance (order processing). 3) Legal obligation - compliance with law (tax records). 4) Vital interests - life/death situations (emergency services). 5) Public task - official functions (government). 6) Legitimate interests - business interests not overridden by data subject rights (fraud prevention, security). Choose most appropriate basis - affects data subject rights. Document basis in privacy policy.
DPO required when: 1) Public authority (except courts). 2) Core activities involve large-scale systematic monitoring (tracking, profiling). 3) Core activities involve large-scale processing of special category data (health, biometric, criminal). "Large-scale" undefined - consider: number of data subjects, volume of data, duration, geographic scope. DPO must: be independent, have expert knowledge, report to highest management, not be dismissed for performing duties. Can be: internal employee, external contractor, shared DPO (for small organizations).
Data breach is security incident causing accidental/unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data. Examples: ransomware, phishing, lost laptop, misconfigured database, insider theft. GDPR obligations: 1) Document all breaches. 2) Notify supervisory authority within 72 hours (if risk to rights). 3) Notify data subjects without delay (if high risk). Notification includes: nature, categories/records affected, consequences, mitigation measures, DPO contact. Penalties for failure to notify: fines up to €10M/2% revenue.
GDPR audit checklist: 1) Data inventory (what data collected, where stored, who accesses). 2) Lawful basis documentation (consent records, legitimate interest assessments). 3) Privacy policy review (complete, current, accessible). 4) Cookie consent validation (banner functional, preferences saved). 5) Data subject rights procedures (SAR process, deletion, portability). 6) Third-party processors (DPAs signed, security validated). 7) Security measures (encryption, access controls, backups). 8) Breach response plan. 9) Staff training. 10) Documentation (processing records, DPIAs). Audit annually minimum.
No, automated GDPR scans only check visible technical elements like cookies and consent banners. Full GDPR compliance requires proper data processing agreements, privacy policies, data subject rights procedures, and internal documentation that cannot be verified by a scan alone.