Website check
Privacy
What gets assessed throughout is the state before any consent, because that is the state that counts legally. A real browser opens the page and records what happens before anyone has clicked on anything. The result is an evidenced inventory of what actually occurs — not of what is documented.
What gets checked
52 individual checks, run together with security in a single pass
-
Cross-check against your privacy policy
Services that demonstrably load but are not named in your privacy policy. In practice the most persuasive finding there is: concrete, verifiable and fixable without argument.
-
Third parties before consent
Everything loaded on a plain page view, classified by provider, purpose and legal jurisdiction — 66 signatures in the knowledge base. Unknown providers are collected and added rather than quietly slipping through.
-
Cookies without consent
Every cookie set, separated into necessary and not necessary, plus lifetimes beyond twelve months.
-
Consent dialog
Is there one at all? And is the reject button on the first level equivalent to accepting — or hidden one level down?
-
Transfers to the United States
Recipients whose processing takes place in the United States, reported as a finding in their own right.
-
Google Fonts from foreign servers
A finding in its own right rather than one third party among many — given the German cease-and-desist climate, this is the point that costs clients money most often.
-
Imprint and privacy policy
Reachable, mandatory information present, and checked for outdated content: references to the old TMG instead of the DDG, and links to the EU dispute resolution platform that was shut down on 20 July 2025.
-
Forms
How data is transmitted, whether the privacy policy is referenced at the point of collection, and whether the recipient sits on a foreign domain.
Standards and references
- GDPR, in particular Art. 5, 6, 13 and 32
- § 25 TDDDG for access to terminal equipment
- § 5 DDG for the mandatory imprint information
What the report contains
An evidenced recipient inventory built from the connections actually observed, findings sorted by weight, plus the list of what needs updating in your privacy policy. The legal notes in the report are there for orientation and are not legal advice.
Where the audit reaches its limit
The legal-text checks work on signal terms: they reliably find missing sections but cannot tell whether an existing section is any good — every legal-text finding is therefore reviewed by hand before the report goes out. Consent dialog detection is a heuristic over element identifiers and button labels; unusually built dialogs escape it, which is why the finding carries a confidence below one and says so in the report. The homepage is what gets audited. And: findings and remediation are our product, the legally binding assessment stays with a lawyer.
Frequently asked questions
What prospective clients most often want to know before commissioning an audit.
We have a consent banner. Is that not enough?
A banner is not evidence that it works. The most common finding is exactly this case: the banner is there, but analytics scripts, map services or fonts load before anyone has clicked on it. What gets assessed throughout is therefore the state before any consent — that is the state that counts legally. On top of that: whether the reject button sits on the first level, equivalent to accepting, or is hidden one level down.
Does the audit replace legal advice?
No, and it is not meant to. The audit establishes technical facts and classifies them: this service loaded before consent, this data went to this recipient in this country. Whether a processing can rest on legitimate interest and how a balancing test turns out is for legal review to decide. Our evidence is what that review builds on — legal advice without a factual basis is expensive and imprecise.
How do you detect transfers to the United States?
Every outgoing connection is recorded and the recipient matched against a knowledge base of 66 provider signatures that knows provider, purpose and legal jurisdiction. Where processing takes place in the United States, that appears as a finding in its own right. It also surfaces the case routinely missing from privacy policies: a European-looking service actually delivered through a US provider. Providers the knowledge base does not yet know are collected and added rather than quietly passed over.
Is the whole website audited?
No — today the homepage, and we say so upfront because it would be obvious from the first report anyway. Subpages in particular tend to embed other services: a map widget on the contact page, a tracker in the checkout. Crawling across several pages is the most important next step and is in progress. Areas behind a login are out of reach for the tool in any case.
How often should a privacy audit run?
At minimum after every content change to the site, so in practice monthly. Privacy findings rarely come from a deliberate decision; they arrive in passing — an embedded video in a blog post, a new widget in the footer, a tag manager update. An annual look misses exactly that.