How to Check if a Website is GDPR Compliant
Checking whether a website is GDPR compliant involves more than looking for a cookie banner. A useful review combines technical observations with an examination of privacy information, data-processing purposes, consent mechanisms and other legal and organizational factors.
Browser-based testing can help document what a website actually does with cookies, tracking technologies and consent choices. However, technical evidence alone cannot establish full GDPR or ePrivacy compliance and should not be treated as legal advice.
1. Review the cookie and consent interface
Start by visiting the website as a new user and examining the consent mechanism that appears. Look at what choices are available and whether the interface provides clear information about cookies or related technologies.
Useful questions include:
- Is a consent interface displayed when relevant?
- What accept, reject or preference controls are available?
- Can the visitor understand the categories or purposes presented?
- Is there a way to access additional cookie or privacy information?
2. Observe what happens before making a choice
The visible banner is only one part of the implementation. Technical observation can show cookies, browser storage, scripts and network requests that appear during the initial visit before the user interacts with the consent mechanism.
This evidence can help identify behavior that deserves further review, particularly when analytics, advertising or other tracking technologies are involved.
3. Compare behavior after consent choices
Where suitable consent controls are available, compare the website's behavior after different interactions. Cookies, browser storage and network activity may change after an accept or reject action.
Documenting those differences can provide useful evidence about how the consent implementation behaves in practice. The meaning of that evidence may still depend on the purpose and legal context of the technologies involved.
4. Review the privacy and cookie information
Technical behavior should also be considered alongside the information provided to visitors. Review the website's privacy policy, cookie policy and other relevant notices to understand what the website says about its processing activities and technologies.
Technical observations can then be compared with those disclosures to identify inconsistencies or questions that may require further investigation.
5. Look beyond cookies
GDPR applies to personal-data processing more broadly, not only to cookies. A complete assessment may need to consider forms, account registration, newsletters, payment processes, third-party services, data retention, security, data-subject rights and other processing activities.
This is one reason a cookie scanner should be treated as a technical auditing tool rather than a complete GDPR certification mechanism.
Manual checks vs automated technical checks
Manual review provides context that automated tools cannot always determine. Automated browser-based scanning, on the other hand, can gather repeatable technical evidence about cookies, tracking behavior, browser storage and consent-related signals.
The two approaches can complement each other. Automated evidence can help locate technical behavior that deserves attention, while human review can evaluate context and issues that cannot be established from browser observations alone.
Common signals that may require further review
During a technical review, findings that may deserve closer examination include:
- Unexpected cookies or browser-storage activity.
- Analytics or advertising requests observed during the initial visit.
- Consent controls that do not produce the expected technical changes.
- Differences between observed behavior and published cookie information.
- Tracking technologies or third-party services that require additional investigation.
These observations are signals for review, not automatic findings of legal non-compliance.
How CookieGDPR can help with the technical review
CookieGDPR uses real browser-based observation to document cookies, browser storage, tracking technologies, network behavior and consent-related signals. Where suitable consent controls can be exercised, the audit can compare evidence across different consent states.
The results are organized as evidence-based findings intended to help website owners, developers, agencies and privacy professionals investigate technical behavior and potential privacy or consent risks.
Can an automated tool confirm that a website is GDPR compliant?
No automated website scanner can by itself make a complete legal determination of GDPR or ePrivacy compliance. A scanner can observe technical behavior, but it cannot independently establish every relevant purpose, lawful basis, contractual arrangement, internal process or organizational measure.
CookieGDPR therefore provides technical observations and evidence rather than a legal compliance certification.
Start a technical website review
You can start with the CookieGDPR free scan for an initial technical review. You can also see how CookieGDPR works, explore the audit features, review a sample report, or compare the Free, PRO and Agency plans.
For more focused information about consent behavior, see our cookie consent check guide or the cookie consent checker.