You give the address
Yours, or a client's. No account, no email.
Cookies · Google Fonts · YouTube · Google Analytics
Free GDPR check for your website
Is your website talking to Google behind your back?
A font here, a YouTube video there, and your website sends every visitor's IP address to strangers before they have clicked on anything. Give us the address. We'll make it talk, then give it a grade.
A: nothing to fix and nothing to check. B: only points to check. After that, each point to fix costs one letter, down to F. Four points or more and the website is a real chatterbox.
Free, no sign-up, no email address. The grade appears on screen in about a minute. Without the box ticked, it is published nowhere.
How it works
Our browser takes a look around
A real Chrome browser visits the home page and up to 4 other pages, like a visitor who hasn't accepted anything yet. It never touches the banner.
Its grade appears, with the list of what it let slip
A discretion grade from A to F, what goes out to third parties, why it matters and how to quiet it down. With a link to pass on to your webmaster.
What we'll make it confess
- Google Fonts, YouTube videos, maps, analytics tools and advertising pixels that load before the visitor chooses anything.
- Cookies and other little notes left in the visitor's browser, before that same choice.
- The cookie banner: whether there is one, and whether it lets people reject as easily as accept.
- Scripts that slip in a few seconds after loading. Invisible in the page code, but not to our browser.
Why it matters, without the drama
In 2022, a German court ordered a website to pay €100 to a visitor because it loaded its fonts from Google. A wave of letters demanding money followed, and the German courts later called out the abuse. The moral: no panic, but no idle chatter either.
What this check is not
It is not a lawyer. It is not the CNIL, France's data protection authority. It looks at what your website loads, and that's all. Your legal notice, your records of processing and what happens to the data once it has left, it knows nothing about, and it won't pretend otherwise.
What we keep (spoiler: almost nothing)
The report lives 30 days, then erases itself. It can only be seen through its link, which we publish nowhere. If the owner ticks the box, only the domain, the grade, the number of points and the date join the public panel, for up to 12 months. Your IP address is used only to slow down people who launch three hundred checks, as a fingerprint erased within two days. A GDPR check that tracked its own visitors would be a bad look, you'll admit.
Questions we get asked
Do I need a cookie banner on my website?
Only if your website sets cookies or contacts services that need the visitor's agreement: analytics that isn't exempt, advertising, social networks, embedded videos or maps. A website that loads nothing from third parties and only sets technical cookies (session, cart, language) doesn't need one. This check tells you which case you're in.
Google Fonts: should I host my fonts myself?
That's the safest option. Loaded from Google, a font sends every visitor's IP address to Google before any choice is made. In 2022, a court in Munich ruled that a website had no right to do this, since the same font can be served by the website itself. Download your fonts and serve them from your website. They look exactly the same.
Does an embedded YouTube video set cookies?
Yes. The player loads with the page, then contacts YouTube and its ad networks, before the visitor clicks on anything. The fix is simple: show a preview image, and load the player only on click.
Does Google Analytics need the visitor's consent?
The CNIL, France's data protection authority, considers that Google Analytics cannot do without the visitor's agreement, in particular because Google reuses the data. So it has to wait for the visitor's choice, or make way for cookie-free analytics set up for your use only.
My website is built with WordPress, Wix or Shopify: does the check work?
Yes. The check visits your website like a visitor, whatever tool built it. When it recognizes the tool, the report says so, and for a website built with WebAcappella Fusion it even names the setting to change.
How can I see for myself what my website loads?
Open your website in a private window, then open the browser's developer tools (F12 key) and go to the Network tab. Each line is a request, and the ones going to a domain other than yours, before any click on the banner, are the ones this check reports. Cookies are listed in the Application tab, or Storage depending on the browser.
What does the A to F grade measure?
How discreet your website is before the visitor chooses. A: nothing to fix and nothing to check among the things we test. B: only points to check, such as a domain we don't recognize. If it is yours, you declare it on the report and it no longer counts, including on later checks. After that, each point to fix costs one letter, down to F. A good grade is not legal advice. It says your website doesn't talk before it has been spoken to.
Does this check replace a GDPR audit?
No. It looks at what your website loads and sets before the visitor chooses, on the home page and up to 4 other pages. An audit also covers how you process data, your information notices, your contracts and what happens after consent.
So what grade will your website get?
One minute, free, no sign-up. At worst, you'll know what to fix.