Is your website breaking GDPR? Find out free — in 10 seconds.
The biggest EU privacy fines — Google €325M, SHEIN €150M, Meta €1.2B — all started with the same technical mistakes most websites still make. Paste your URL and get a plain-language compliance score: no sign-up, nothing installed, works on every platform.
What the check looks at
The scan runs nine technical checks against your live page. Its privacy checks read served HTML and response headers rather than observing a visitor session:
| Static signal | Why it matters |
|---|---|
| Tracker and consent markers | Known analytics or ad scripts are compared with consent-platform markers in the HTML. Runtime request order is not observed. |
| Google Consent Mode v2 markers | Looks for the expected v2 parameter names in source; it does not prove correct browser behaviour. |
| IAB TCF markers | Looks for Transparency & Consent Framework signatures in source; it does not execute a TCF string. |
| HTTPS & security headers | Checks observable transport and response headers relevant to GDPR Art. 32 and NIS2 risk-management reviews. |
| Privacy policy link | Looks for common policy paths and links. Legal adequacy and all required notices still need human review. |
Important: this is a static technical check, not a browser session, network trace or legal compliance audit.
The three mistakes that cost real companies millions
- Cookies fire before the click. Open your own site in an incognito window with dev tools open — if network requests hit analytics or ad domains before you touch the banner, you have tracking before consent. This is a common finding in enforcement actions against ordinary company sites.
- "Reject all" is harder than "Accept all". Equal prominence, equal number of clicks, first banner layer — anything less is a dark pattern under the standard set by CNIL's decisions against Meta and Google.
- Rejecting changes nothing. Click "Reject all", reload, and watch whether the same cookies fire again. Misconfigured tag managers make this one of the most common audit findings.
Deeper background: the GDPR cookie fines tracker and the EU cookie consent guide 2026.
Frequently asked questions
Is my website legally required to be GDPR compliant?
If you have visitors from the EU/EEA — even a single one — yes. GDPR and the ePrivacy rules apply based on where your visitors are, not where your company is. A US or Asian webshop shipping to Europe is fully in scope, which is why enforcement has reached companies far outside the EU.
What happens if my site fails a compliance check?
EU data protection authorities can fine up to €20 million or 4% of global revenue under GDPR, plus ePrivacy sanctions. Recent decisions include €325M against Google and €150M against SHEIN for consent failures. Most proceedings against ordinary business sites begin with a single complaint — often from a competitor or a privacy activist running automated checks like this one.
Doesn't my platform handle cookie compliance automatically?
No platform guarantees compliance out of the box. WordPress plugins, Shopify apps and Squarespace banners all require correct configuration — and misconfiguration is itself a common violation. Compliance depends on how your scripts and consent tool are set up, which is exactly why testing the live page matters regardless of platform.
Can I check without installing anything?
Yes. This checker fetches your public page HTML and analyses it server-side. Nothing is installed on your site, and no account is needed. It works identically on WordPress, Shopify, Wix, Squarespace, Webflow, Next.js or hand-coded sites.