GDPR & ePrivacy website scanner

GDPR website scanner

A GDPR website scanner checks public pages for cookies, tracking, consent controls and privacy disclosures that need review. Enter a URL below to run a free scan of one public page and inspect the retained evidence. Results help you investigate GDPR and ePrivacy risk signals; they do not certify compliance.

By CertScore.ai · Updated October 4, 2026

Run free scan View sample report

CertScore.ai scans public website behavior for review signals. Findings are automated observations backed by retained evidence, not legal advice, certification, or compliance determinations.

What the scan reviews

Pre-consent tracking

Third-party cookies before consent

Consent UX and Accept/Reject behavior

Policy/runtime disclosure gaps

Session replay and fingerprinting-related signals

Scan a public website

Loading scan form…

From a scan to a reviewable decision

Check the context. Open the report and confirm the target, scan date, region, and coverage. A blocked or incomplete observation is a limitation, not evidence of an absent control.
Inspect the observation. Follow a finding to its retained request, cookie, storage, or policy evidence. Keep pre-consent activity separate from activity after an Accept or Reject click.
Verify the interpretation. A visible Reject button, a completed click, and confirmed refusal are different facts. A cookie remaining in storage does not by itself prove active tracking.
Assign and retest. Give the responsible team the affected vendor, page, consent state, and evidence. After a configuration change, compare a new scan under the same conditions.

Use the sample report to explore the report format; it describes its own retained scan, not your website.

Read the annotated report example Explore the sample report Follow the Reject testing walkthrough Use the audit checklist

What a GDPR website checker can show

Review observed cookies and storage, tracking requests, available Accept/Reject/Options controls, privacy disclosures, and session replay or fingerprinting-related signals. Each result is bounded by the scanned page, region, visit and available evidence.

Example: investigate a request before consent

If a report flags a tracking request before consent, open its retained evidence and check the vendor, request timing and consent context. Give the implementation owner the affected page and evidence reference so they can inspect the tag trigger. This is a review example, not a finding about your website.

Example: review forms alongside replay signals

A replay-service signal and a form inventory answer different questions. Inspect the service evidence and the form’s page before checking masking, consent configuration and the privacy notice. Even same-page co-presence does not prove that the service recorded inputs.

What this scan cannot establish

Public-page observation does not cover private account flows, every page, every region, or all future behavior. Bot defenses and unavailable controls can limit coverage. Accept and Reject observations are separate eligible sessions; an unverified decision stays unverified. A clean observation is not a compliance certificate.

From an observation to a fix

Share the report’s target, date, region, affected vendor or storage identity, consent state and retained evidence reference. Review the relevant tag trigger, consent category, embedded service or disclosure with its owner. After a change, compare a fresh scan under the same conditions.

When to use a broader review

Start with one public page, then review important templates such as contact, booking and checkout pages within your access and crawl limits. A website scan cannot assess your internal processing records, contracts or every use of personal data. Combine technical evidence with your organization’s privacy review.

Frequently asked questions

Can CertScore.ai tell me if a website is GDPR compliant?

No. CertScore.ai provides automated public-web observations for human and agentic review. It does not provide legal advice, certification, proof of non-compliance, or a GDPR compliance determination.

What does a GDPR website scanner look for?

It can look for consent timing, cookies, storage, tracking requests, vendor domains, session replay indicators, fingerprinting-related signals, privacy disclosures, and whether runtime behavior appears aligned with consent and policy surfaces.

Does CertScore.ai scan behind logins?

This page describes public-web scanning. Authenticated areas, paywalls, bot protections, and blocked routes can limit coverage unless a separate approved workflow is configured.

Key takeaways

CertScore.ai is a public website scanning platform that surfaces GDPR-relevant consent, cookie, tracking, policy, and disclosure review signals.

CertScore.ai findings are automated observations backed by retained evidence. They are not legal advice, certification, or compliance determinations.

Related CertScore.ai pages

Session replay study: evidence and limitations Review forms and field evidence How to interpret GDPR website evidence CMP verification RTB cookie syncing Sample report