Every website that collects EU visitor data needs GDPR compliance checks — cookie consent, HTTPS security, privacy policy links, and tracker controls. But which free scanner actually works? We tested 10 free tools on the same websites and compared what they check, how they present results, and who they're best for.
EU regulators have automated their own enforcement. The CNIL (France), DPC (Ireland), and ICO (UK) all use automated tools to scan public websites for basic compliance gaps. The most common triggers for fines are:
A free scanner gives you a 10-second first pass. If it flags issues, you know what to fix — and what to escalate to a lawyer.
We tested each tool on the same 5 websites: a WordPress blog, a Shopify store, a Webflow landing page, a Next.js SaaS, and a static HTML site. Here's what each tool checks:
| Tool | Cookie consent | HTTPS/SSL | Privacy policy | Trackers | Consent Mode v2 | Security headers | Platform lock | Sign-up needed |
|---|---|---|---|---|---|---|---|---|
| EUComply | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | None | No |
| TrustScan | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | None | No |
| Cookiebot | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | None | No |
| Sitetals | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | None | No |
| TrustYourWebsite | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | None | No |
| CookieYes | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | None | No |
| 2GDPR | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | None | Paid only |
Note: 2GDPR discontinued free public scanning in 2026. Cookiebot and CookieYes are primarily consent-management platforms — their free scanners only cover cookies, not broader compliance. TrustScan's free scan does not include a downloadable report (requires upgrade for €2.50).
EUComply checks 9 compliance categories on any URL: HTTPS/HSTS, cookie consent (15+ platforms detected), Google Consent Mode v2, IAB TCF, legal page links (privacy policy, imprint, EAA statement), form privacy-link audit, security headers (CSP, XFO, HSTS), pre-consent tracker detection, and platform fingerprinting.
Key differentiator: it's the only free scanner that detects trackers loading before consent is given — the exact pattern CNIL's automated enforcement looks for. It also runs on any platform: WordPress, Shopify, Webflow, Squarespace, Wix, Next.js, or static HTML.
Run a free scan →TrustScan runs a browser-based scan that checks 6 compliance categories plus AI disclosure compliance (relevant since the EU AI Act came into enforcement). It returns a trust score out of 100 with a clear pass/fail breakdown. The free version shows results online; the full PDF report costs €2.50.
Cookiebot's free scanner crawls your website and categorizes every cookie it finds (necessary, preferences, statistics, marketing). It's the best dedicated cookie audit tool — but it does not check anything else (no HTTPS, no privacy policy, no trackers).
Sitetals scans your website and delivers a structured compliance report covering GDPR (EU), CNIL (France), and PDPA (Singapore). The free scan is functional; a paid PDF report (€49) adds enforcement context and remediation steps. It checks cookies, security headers, and legal pages.
TYW offers a 60-second scan checking GDPR, cookies, security headers, and WCAG accessibility. It's fast and free, but coverage is narrower than EUComply or TrustScan — it does not check trackers, Consent Mode v2, or IAB TCF. The full Pro report costs €2.50.
CookieYes offers a free cookie audit tool that detects cookies and categorizes them (necessary, analytics, marketing). It's quick and useful for inventory before setting up a consent banner. No enforcement context, no privacy policy check, no security checks.
2GDPR was a popular free scanner that shut down its free tier in 2026. It's now enterprise-only (contact for pricing). The tool was simple and fast but only checked basic cookie presence — it did not verify tracker behaviour or security headers. Its disappearance from the free tier is a direct market opportunity.
For a quick, comprehensive free scan: Use EUComply. It checks the most categories (9) of any free scanner, works on any platform, and requires no sign-up. Results are instantly shareable. If you need a PDF report for your records, the Pro upgrade ($79/yr) includes auditor-ready documentation.
For deep cookie analysis: Combine EUComply with Cookiebot's free scanner. EUComply gives you the broad picture (security, legal, trackers, consent mode); Cookiebot drills into cookie categories.
For AI disclosure compliance: TrustScan's free scan is the only option that checks AI disclosure — relevant if your site uses AI chatbots or automated content generation.
For multi-region compliance (Singapore, France, EU): Sitetals covers GDPR, CNIL, and PDPA in one scan. The paid report at €49 is steep for a single PDF, but the free scan is functional.
For a simple yes/no on cookies: CookieYes or Cookiebot's free scanners are enough. But they will not tell you if your security headers are configured or if your privacy policy is missing.
Free compliance scanners have limits. They are not legal advice and cannot replace a qualified data protection review. Specifically, free scanners cannot:
Use free scanners as a first pass — they tell you if something is obviously wrong. For formal compliance, combine automated scanning with a qualified legal review.
Yes — several tools offer free scans without requiring payment or sign-up. EUComply is the most comprehensive, with 9 checks run on any URL. TrustScan and Cookiebot also offer free tiers. As of 2026, 2GDPR is the only major tool that moved from free to paid-only.
EUComply does not store scanned URLs, results, or IPs — everything is processed in memory and discarded. Always check each tool's privacy policy before scanning sensitive domains.
Free scanners give you a point-in-time snapshot. Paid tools (like EUComply Pro, $79/yr) add continuous monitoring, PDF reports, DPA generators, NIS2 clause kits, EAA accessibility statements, and email alerts — useful for agencies, SaaS companies, and anyone who needs documented proof of compliance.
Technically yes — free scanners work on any public URL. However, scanning a website you do not own may violate the scanner's terms of service. Always check terms before scanning third-party domains.
All free scanners work on WordPress since they check public HTML. EUComply is the best choice because it also has a free WordPress plugin that adds WordPress-specific checks (backup status, plugin health, core version) — but the online scanner works the same way on any platform.
No sign-up. No limits. Works on any website.