Online GDPR validator
Check whether your website has the technical signals expected for GDPR and ePrivacy readiness, including cookie consent, tracker behavior, privacy links, and consent evidence. Free online check — no signup required.
Technical checks only, not legal advice.
An online GDPR validator should inspect what a visitor and a regulator would see on first visit: is there a cookie banner? Do Accept and Reject both work? Are analytics and marketing trackers waiting for consent before they fire? GDPRChecker answers these questions with a structured report.
Each finding is tied to a specific signal — a network request, a missing policy link, a cookie set before consent. The report explains what was detected and why it matters, so you can prioritize fixes without interpreting raw network logs or HTML.
After the check, use GDPRChecker to deploy a cookie banner with runtime enforcement, review and publish a cookie declaration, generate privacy and cookie policies, and set up scheduled scans so new issues are caught before they accumulate.
The validator loads your homepage as a first-time EU visitor would — no cookies, no prior consent, a clean browser session. It inspects six categories of technical signals. First, cookie banner detection: is a consent banner present, and does it offer Accept all, Reject all, and granular preferences with equal visual weight? Second, consent choice enforcement: when a user clicks Reject all, do analytics and marketing scripts actually stop, or do they continue firing regardless? Third, pre-consent network requests: does the page send data to Google Analytics, Meta, or other tracking endpoints before the visitor has made any consent choice? Fourth, policy link discoverability: are privacy policy and cookie policy links present, reachable, and returning valid content? Fifth, tracker inventory: which third-party scripts, pixels, and cookies are active on the page, and what categories do they fall into? Sixth, consent evidence: for sites using GDPRChecker's managed platform, are consent records being captured with timestamps, category choices, and policy version identifiers? Each check produces a specific finding, not a guess or a generic risk score.
This is a technical readiness check, not a legal audit. It inspects what a browser can observe: cookie banners, network requests, script behavior, policy links, and consent signals. It does not review your data processing agreements, assess the lawfulness of your processing purposes, evaluate your legitimate interest assessments, or verify your data subject request procedures. A clean technical check means your site's public-facing privacy signals are in order — that is necessary but not sufficient for full GDPR compliance. Use the check to identify technical issues and prioritize fixes. Confirm the legal completeness of your compliance program with qualified privacy counsel. No automated tool can guarantee GDPR compliance, and GDPRChecker does not claim to.
After running a check, the report surfaces findings in a structured format. A site with issues might show: Cookie banner: detected but Reject all is missing from the first layer — users must click through a preferences panel to decline tracking. Pre-consent trackers: Google Analytics (googletagmanager.com) and Meta Pixel (connect.facebook.net) fire network requests before any consent interaction. Privacy policy link: found and reachable. Cookie policy: linked but the page lists only three cookies while the scanner detected eight — the declaration is out of date. Consent records: not available — consent logging is not active for this site. Recommended fixes: add Reject all to the first banner layer, move the CMP script before GTM in the head, block GA4 and Meta Pixel until analytics and marketing consent is granted, update the cookie declaration to match detected cookies, and enable consent logging. The report provides the signal evidence for each finding so your developer can trace it directly.
The most frequent findings across thousands of scans follow consistent patterns. Analytics loads before consent: GA4, GTM, or gtag.js fires on page load before the visitor sees the banner — typically because the CMP script loads after the analytics script in the HTML head. Reject button is hidden or missing: the banner shows Accept all prominently but Reject all is buried in a settings panel, styled as a low-contrast link, or absent entirely. Meta Pixel fires before marketing consent: the pixel's PageView event triggers on load regardless of consent state, sending event data to Meta before any user choice. Cookie policy is outdated: the published policy lists cookies from a previous vendor setup and misses new pixels added through GTM in the last quarter. No consent records exist: the banner collects choices but does not log them with timestamps and policy versions, making Article 7(1) accountability impossible. Privacy policy does not mention actual trackers: the privacy notice describes data processing in general terms but never names Google Analytics, Meta, or other specific tools the site actively uses. Each of these issues is detectable through automated technical checks and fixable with configuration changes.
The check identifies issues. The platform provides the tools to fix them and stay fixed. Deploy a cookie consent banner with runtime enforcement: configure categories, publish the banner, and the runtime blocks analytics and marketing scripts until consent is granted — closing the gap between what the banner says and what the page does. Review and publish a cookie declaration: detected cookies and trackers feed into the inventory where you can re-categorize, approve, and publish a declaration that matches your live site. Generate privacy and cookie policies: policy generators produce structured pages that reference your actual tracker inventory and consent configuration, not generic templates. Run scheduled scans with change alerts: configure weekly or daily scans; when a new cookie or tracker appears, the system sends an alert so you can review and update before it becomes a compliance finding. Build consent records for accountability: consent events are logged with timestamps, category choices, and policy version identifiers — exportable on demand. Each tool connects to the next, forming a repeatable compliance maintenance workflow rather than a one-time project.
| What is evaluated | Automated technical check | Legal / manual audit |
|---|---|---|
| Cookie banner visibility | Detects banner DOM presence, button parity, and policy links | Reviews banner wording for transparency, fairness, and jurisdiction-specific requirements |
| Pre-consent tracker behavior | Flags network requests to tracking domains before consent interaction | Determines whether flagged requests qualify for strict necessity exemption |
| Cookie inventory | Catalogs detected cookies with provider, name, and suggested category | Reviews category accuracy, purpose descriptions, and retention justification for each cookie |
| Policy discoverability | Checks privacy and cookie policy links are present and reachable | Reviews policy content for Article 13/14 disclosures, DPA references, and data subject rights |
| Consent records | Verifies consent logging is active and captures timestamp/categories/version | Assesses whether consent records meet Article 7(1) demonstration requirements |
| Ongoing monitoring | Automated scheduled scans with change detection and alerts | Reviews whether monitoring cadence meets regulatory expectations for your risk profile |
Related GDPRChecker tools
GDPRChecker provides automated technical checks, templates, and operational guidance. It does not provide legal advice and does not guarantee compliance with GDPR, UK GDPR, ePrivacy, CCPA, PIPEDA, Law 25, or any other law.