GDPR Check

What does your website actually load?

Scan a URL for tracking and marketing services, cookies and third-country transfers, with a risk rating and legal basis for each detected service. The check also examines the privacy policy for the mandatory information under Art. 13 GDPR.

GDPR Check

Use our free GDPR Check.

How we process your input is explained in our privacy policy.

Please note: Automated analysis of the publicly loadable HTML source. Scripts loaded dynamically behind a consent banner are not detected. The result of this check is a free, automated first assessment and therefore a rough indication only. It does not replace a review of the individual case or legal advice. We accept no liability for the accuracy or completeness of the result.

Background

Third-country transfer: an underestimated risk.

Every transfer of personal data (which already includes the IP address) to providers outside the EU/EEA requires a legal basis. For US providers, the EU-US Data Privacy Framework has applied since July 2023.

What the check reveals

  • Tracking and analytics services, including ones that load before consent
  • Cookies and local storage (local/session storage)
  • Data flows to US providers and other third countries
  • Embedded services: maps, videos, fonts, social-media plugins

Cookies require consent

Storing and reading information on the device is only permitted with consent under § 25 TDDDG, unless it is strictly technically necessary. Analytics and marketing cookies never qualify.

Assessing US services correctly

If the US recipient is certified under the Data Privacy Framework, an adequacy decision applies (Art. 45 GDPR). Otherwise standard contractual clauses with additional safeguards or valid consent (Art. 49 GDPR) are required.

Need advice on data protection?

Detected a high risk? We run a full website review and draft a legally sound privacy policy.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

From the blog

Further reading on the topic.

Frequent questions

What clients often ask.

What does the GDPR check examine?
Common tracking, marketing, CDN, payment and consent services, from Google Analytics and the Meta Pixel to privacy-friendly alternatives like Matomo or Plausible, each with country of origin, risk rating and legal basis. With every scan it also loads the linked privacy policy and checks whether it contains the mandatory information under Art. 13 GDPR: controller, server log files with IP address, legal bases, retention period, the right to lodge a complaint and each data subject right on its own. This applies to sites without any third party too. If the policy is missing or lacks mandatory information, the check rates the risk as high.
Why is Google Fonts flagged as a risk when it only loads fonts?
When Google Fonts is loaded from Google's CDN, visitors' IP addresses are transmitted to Google LLC in the US. A German court (LG München I) ruled in 2022 that this requires consent, regardless of the content being loaded.
Does the scan also detect scripts hidden behind a cookie banner?
No. The check inspects the HTML source delivered on first load. Services that are only loaded dynamically after consent do not show up in the scan, which is the correct behaviour for a properly implemented consent setup.
Does the GDPR check also cover accessibility (German BFSG)?
Yes, as an additional module. It checks statically detectable BFSG/WCAG criteria such as the language attribute, alt text, form labels, and a blocked zoom in the viewport setting. Colour contrast, keyboard operability and screen-reader behaviour are not covered, this does not replace a full WCAG review.
Is using the GDPR check free?
Yes, completely free and without registration. The scan only analyses the publicly loadable source code of your website and stores no personal data.