GDPR · ePrivacy · technical check
GDPR Website Check: what does your site load before anyone consents?
Google Fonts, Analytics, Meta Pixel, YouTube, Google Maps: enter an address and see what is sent to third parties on the first visit. No sign-up, nothing stored.
Check for free
We check the HTML a visitor receives before any consent. The address is not stored.
Found something? The GDPR Website Fix Kit
The check shows what stands out. The kit shows step by step how to fix it – without an agency.
Host Google Fonts locally
Download and serve fonts yourself: instructions for WordPress, Shopify, Wix and custom code, with ready-made CSS.
Click-to-load for YouTube and Maps
Copy-paste block: preview instead of embed, loaded only after a click. No plugin, no library.
Tracking only after consent
How to block Analytics, pixels and co. until consent – with examples for common consent tools.
Security headers and checklist
Ready lines for .htaccess, nginx, Cloudflare and Netlify, plus a checklist for everything a tool cannot see.
€19
one-off, incl. VAT, instant access in your browser, works offline
Secure payment via Stripe.
Prefer a measurement?
The check reads the source code. The network report opens your website in a real browser, clicks nothing and records which third parties and cookies actually load before consent – with screenshot and concrete steps, as PDF by email within 2 business days. The kit is included instantly.
€39
one-off, incl. VAT · you enter the website address at checkout
FAQ
Is loading Google Fonts from Google's servers GDPR compliant?
In January 2022 the Regional Court of Munich (case 3 O 17493/20) ruled that passing a visitor's IP address to Google by dynamically loading Google Fonts without consent was unlawful and awarded damages. The safe solution is to host the fonts on your own server.
What does the check test?
The HTML a visitor receives before any consent: Google Fonts, tracking scripts (Google Analytics/Tag Manager, Meta Pixel, Hotjar, Clarity, TikTok, LinkedIn, Pinterest) and whether a consent tool is detectable, YouTube, Maps and social media embeds, third-party CDNs, reCAPTCHA, HTTPS, a privacy policy link, a leftover EU ODR platform link and security headers.
Does the check replace legal advice?
No. It shows technical findings that can be detected automatically. Whether processing is lawful and what belongs in your privacy policy is a question for a professional.
Why does the check find nothing although my banner loads tracking?
The check sees the page like a visitor who has not consented yet. Anything loaded only after a click does not appear – which is exactly how it should be.