GDPR compliance and privacy
Are the visible elements related to the obligations that apply to your site properly present and configured? We check what your site actually shows and sends from outside: required information, consent mechanisms, privacy policy, cookies and third-party flows.
Try our method for free
One page. One pillar. A real report.
Enter your website and we’ll email you a report on Compliance & privacy for your home page. Please allow at least 24 hours.
Our plans cover the 9 pillars across the pages of your whole site.
What we check
- What is written into the browser before any interaction: we load the page without clicking anything, and record what is already there.
- The consent mechanism as it works, not as it announces itself: refusing must be as simple as accepting.
- Every third-party recipient of the visit, named and classified: audience measurement, tag manager, advertising, social networks, fonts, bot protection, maps, video.
- The legal notice French law requires you to display about the publisher, the host and the publishing director, and, on an online store, the obligations specific to selling online.
- On an online store, what consumer law requires you to show the customer: the legal guarantee of conformity, the right of withdrawal, the consumer mediator, an order button that says it commits the buyer to pay, and information on whether reviews are verified. A link still pointing to the former EU online dispute resolution platform is flagged too.
- The privacy policy: whether it exists, and which processing, purposes and rights it sets out.
- Heightened surveillance devices: session recording, which replays a visitor’s navigation, and browser fingerprinting, which needs no cookie.
What we find on the sites we audit
Across about 20 websites we audited between August 14, 2026 and September 24, 2026:
- 25% have a legal notice missing a required item
- 15% have a legal notice that none of the visited pages links to
Each percentage covers the sites where the point could be checked. Many were audited because a defect showed up quickly, so these figures describe our audits, not websites in general.
See also: hosting, vendor lock-in and resilience; a real online store report.
On what basis
GDPR · ePrivacy Directive · French LCEN · CNIL guidance
A finding is only worth something if it rests on an identifiable basis. Where one exists, we rely on a law, a standard or a specification, and for every point recorded the report names the page and gives the value we measured.
What it changes for you
The most common fault is also the simplest to establish from outside: trackers set before the visitor has answered anything at all. A consent banner can be perfectly worded and perfectly ineffective.
These failures are visible from any browser, to anyone: a competitor, an unhappy customer, an association. That is what sets them apart from a theoretical risk.
The weight of this pillar
An overall score has to weigh what matters for your business: the 9 pillars do not carry the same weight depending on what your site is for. Here is what “compliance & privacy” represents in the overall score, under each weighting. The report always states which one produced your score.
| Type of site | Share of the overall score |
|---|---|
| Type not determined | 13% |
| Business / brochure site | 12% |
| E-commerce site | 16% |
| Application / customer portal | 13% |
| Blog / media site | 7% |
| Public-sector site | 15% |
This pillar is examined alongside the other eight in every plan, whatever the number of pages. See pricing →
Guides for this pillar
Website imprint requirements in the EU
The details an EU business website must publish about who runs it, what France adds, the flaws that make a legal notice useless, and the fixes to ask for.
Read the guide →Session recording and GDPR: consent first
Hotjar, Microsoft Clarity and similar tools replay each visit. For EU visitors they need consent before recording, masked inputs and short retention.
Read the guide →EU ecommerce legal requirements, explained
Guarantee, withdrawal, dispute body, order button, reviews: what your online store must display to EU consumers in 2026, rule by rule, and what to fix first.
Read the guide →EU legal guarantee of conformity for stores
What an online store must tell buyers about the legal guarantee: the EU notice applying since September 27, 2026, the French terms box, and warranties.
Read the guide →Consumer mediation in the EU: what to show
Selling to EU consumers? Name the dispute body that covers you, with its website, on your store and in your terms. In France, a mediator is mandatory.
Read the guide →Right of withdrawal in the EU, for sellers
What an online store must tell EU buyers about withdrawal: 14 days, the model form, return costs, exceptions, and the online withdrawal button.
Read the guide →EU ODR platform closed: remove the link
The EU online dispute resolution platform closed on July 20, 2025. The link to remove from your store, and the dispute body you still have to name.
Read the guide →Order with obligation to pay: button rules
In the EU, the button that places an online order must say it commits the buyer to pay. Why "Continue" falls short, and what the EU Court of Justice ruled.
Read the guide →Online review verification rules in the EU
In the EU, a site that shows customer reviews must say whether and how it checks they come from real buyers. Not checking is allowed; saying nothing is not.
Read the guide →