LastingWeb

Free tool · No signup

GDPR & privacy website check

We load your site like a first-time visitor and record every third party it contacts, every cookie it sets and every tracker that fires before consent.

No signup · Results in ~40 seconds · Nothing stored except the shareable report

What we check and why

What the privacy check detects

When a visitor opens your site, their browser often contacts servers you never think about: analytics, tag managers, font services, video and map embeds, chat widgets. Each request discloses at least the visitor's IP address to that third party. We load your page in headless Chrome without accepting anything and record what happens.

  • Third-party hosts contacted on the first load.
  • Known trackers: Google Analytics, Google Tag Manager, Meta Pixel, DoubleClick, Hotjar, LinkedIn Insight, TikTok and Microsoft Clarity.
  • Google Fonts loaded from fonts.googleapis.com or fonts.gstatic.com.
  • YouTube embeds without privacy-enhanced mode and Google Maps embeds.
  • Cookies set before any consent was given.
  • A consent banner from common platforms such as Cookiebot, OneTrust, Usercentrics, iubenda, Complianz, CookieYes, Klaro or Borlabs.
  • Links to a privacy policy and an imprint (Impressum), and visible contact details.

Why this matters for professional firms

Under the ePrivacy rules, as implemented in each member state, storing or reading non-essential cookies requires prior consent, and the GDPR requires a legal basis for transferring personal data such as IP addresses to third parties. Regulators across Europe have issued guidance and fines over cookie banners and analytics tools, and in January 2022 the Regional Court of Munich (LG München I, 3 O 17493/20) awarded damages to a visitor because a website loaded Google Fonts from Google's servers without consent.

For a law firm, notary or accountant, the reputational stakes are higher than the fines. Clients expect the people who handle their confidential matters to handle their data carefully, starting with the website.

Typical fixes

Self-host web fonts instead of loading them from Google. Load analytics, tag managers and marketing pixels only after the visitor has consented, or switch to a privacy-friendly analytics tool that does not need cookies. Replace YouTube embeds with youtube-nocookie.com or a click-to-load placeholder, and do the same for maps. Make sure your banner offers "reject" as easily as "accept", and that your privacy policy names the third parties you actually use.

In Germany and Austria every business website needs an imprint with legally prescribed details; other countries have similar information duties under the EU e-Commerce Directive.

Going further

This check looks at a first visit without interaction. To see what happens after a visitor clicks reject or accept on your cookie banner, run our GDPR cookie consent checker, which visits the page three times in a real browser and compares the cookies, storage and trackers of each visit. Together the two reports give your data protection adviser a concrete technical picture to review.

Frequently asked questions

Is this a legal GDPR compliance check?

No. It detects technical facts — which third parties are contacted and which cookies are set before consent — and explains why they are relevant. Whether your site is compliant overall is a legal assessment for your data protection officer or counsel.

Why is Google Fonts flagged?

Loading fonts from Google's servers sends each visitor's IP address to Google. A German court held in 2022 that doing this without consent breached the GDPR. Self-hosting the same fonts avoids the issue entirely.

My cookie banner is installed. Why are trackers still detected?

Many banners are configured to display a notice but not to block scripts until consent. The check shows what loads before any click; if trackers appear, configure the banner or tag manager to hold them back.

Do I need a cookie banner if I use no tracking?

If your site only uses strictly necessary cookies and contacts no third parties that require consent, a consent banner is generally not required. You still need a privacy policy explaining what data you process.

What is an imprint or Impressum?

A legally required page with the provider's identity and contact details, register entries and, for regulated professions, the professional body and rules. It is mandatory in Germany and Austria, and similar information duties apply across the EU.

Related free tools

Cookie Consent Checker We visit your site three times — ignoring, rejecting and accepting the cookie banner — and show what loads each time, so you can see whether the banner actually works. Third-Party Script Audit Each outside script slows your page, and many share visitor data. See which third parties your site calls, what each one costs and which you could drop. Tracking Audit Can you tell which marketing brings you clients? We inspect the tags, pixels and events your site fires and flag duplicates, gaps and legacy setups. Security Headers HSTS, Content-Security-Policy, frame protection, cookie flags, exposed files and version leaks — checked from the outside, the way an attacker would look.

Done for you

Want these fixed? We build it right.

LastingWeb builds fast, secure, compliant websites for professional firms — hosting, TLS, email authentication and GDPR-friendly analytics included.

See packages