The GDPR for website owners
A beginner's guide to what the GDPR asks of a website.
GDPR compliance scanner
See what loads before consent.
The scanner opens one page the way a new visitor would and checks six areas: the consent banner, cookies and trackers set before any choice, HTTPS, the privacy policy and Google Consent Mode.
It reports what it finds on that page. It is not a legal assessment.
Free, no account needed
Starting the scan
You can stay on this page. The results appear here when the scan finishes.
This is taking longer than usual. The scan is still running.
The scan didn't finish
Some websites block automated scanners with a firewall or bot protection.
What it checks
Six areas, one page.
Each area is a fact about the page you enter. The results say what was found and what to fix.
Consent banner
Finds the banner and checks for an accept button, a reject button beside it, a settings link and pre-ticked boxes.
Cookies before a choice
Lists every cookie set before the visitor clicks anything, and separates common essential cookies from the rest.
Trackers before a choice
Looks for requests to more than 40 known analytics and advertising services, such as Google Analytics and Meta Pixel.
HTTPS and security headers
Checks that the page loads over HTTPS and sends the HSTS, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy headers.
Privacy policy
Finds the privacy policy and looks for 10 topics a GDPR privacy policy commonly covers, such as the data controller and data subject rights.
Google Consent Mode
When the page loads Google tags, checks for Consent Mode defaults that deny storage and for update commands.
How it works
It sees the page before anyone clicks.
The scanner never answers the banner, so everything it records happened before a visitor made a choice.
-
Step 1: Enter a page address
Any public page works. Most people start with their homepage. -
Step 2: The scanner loads the page
It opens the page as a new visitor with no cookies, records every cookie and request, and then looks for the privacy policy. -
Step 3: Read what it found
Each of the six checks shows what was found and any issue to fix. The results describe one page; they are not a legal assessment.
A checklist
What a consent setup usually includes.
The points the scanner looks for, and where each one comes from.
Accept all and Reject all, side by side
Most EU data protection authorities treat a banner layer with an accept button but no reject option as an infringement, according to the EDPB cookie banner taskforce report of January 2023.
No analytics or marketing cookies before consent
Cookies that are not strictly necessary wait for the visitor's consent (Article 5(3) of the ePrivacy Directive).
Third-party scripts held back
Google Analytics, Meta Pixel and similar scripts run only after the visitor accepts their category.
Withdrawing is as easy as agreeing
Article 7(3) GDPR requires it, so visitors need a way back to their choice, such as a cookie settings button.
A privacy policy that covers the basics
Articles 13 and 14 GDPR list what people must be told, including who the controller is and what rights they have.
Google Consent Mode v2 with Google advertising tags
Since March 2024, Google asks for it before its audience features use data from visitors in the EEA.
Read the EDPB cookie banner taskforce report (opens in a new tab) for the practices regulators have looked at.
Questions about the GDPR compliance scanner
What does the GDPR compliance scanner check?
One page of a website, in six areas: the consent banner (an accept button, a reject button beside it, a settings link, pre-ticked boxes), cookies set before any choice, known trackers loading before any choice, HTTPS and security headers, the privacy policy, and Google Consent Mode when the page loads Google tags. Each area is reported as passed, or with the issues it found.
Is the scanner free?
Yes. You can run 3 scans a day without an account. Signed in, your account can run up to 50 scans across the free tools in 24 hours.
Does a passed check mean my website complies with the GDPR?
No. The scanner checks one page for common consent signals and reports what it finds. Whether a website complies with the GDPR depends on much more, such as what personal data it processes and why. The results are not a legal assessment.
Why do cookies set before a choice matter?
Under Article 5(3) of the ePrivacy Directive, cookies that are not strictly necessary need the visitor's consent before they are set, and the GDPR defines what valid consent is. An analytics or advertising cookie that appears before the visitor answers the banner is set without that consent.
What is a cookie consent banner?
A notice that tells visitors which cookies and similar technologies a website uses and asks for their consent. It offers a way to accept and a way to reject the cookies that are not strictly necessary, before any of them are set.
Why does the scanner look for a reject button?
Because refusing should be as easy as accepting. Article 7(3) GDPR requires withdrawing consent to be as easy as giving it, and the EDPB cookie banner taskforce report (January 2023) records that most EU data protection authorities treat a banner layer with an accept button but no reject option as an infringement.
What does a privacy policy usually cover?
Articles 13 and 14 GDPR list what people must be told about how their data is used. The scanner looks for 10 topics a GDPR privacy policy commonly covers: the data controller, the legal basis, data subject rights, retention, third parties, international transfers, the contact details of a data protection officer, cookies, children's data and the right to complain to a supervisory authority.
How do I fix the issues the scanner finds?
Each issue says what was found. Most come from the consent setup: a banner with accept and reject buttons side by side, analytics and marketing scripts held back until the visitor agrees, and a privacy policy that covers the missing topics. Kukie.io can show the banner and hold back known trackers, and its Legal Document Generator writes a privacy policy from your answers.
Learn more
Guides for the issues it finds.
Plain explanations of the checks, and the other free tools for a closer look.
Common cookie consent mistakes
The problems scans find most often, and how to fix them.
Essential and non-essential cookies
How to tell which cookies need consent.
What happens when visitors reject all
Why the reject button matters, and what it should do.
Cookie scanner
List every cookie across up to 10 pages of a website.
Script audit
See every third-party script a page loads before the visitor chooses.
Ask before you track.
Kukie.io shows a banner with Accept all and Reject all side by side, holds back known trackers until visitors agree and records every choice.
Disclaimer
Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.
