Data protection check (GDPR)

What we check

We read the same files as for the security check: the homepage HTML, its stylesheets and JavaScript files from your domain, and the cookies the server sets on the first visit. From these we spot common data protection mistakes that often lead to legal warnings in Germany. We don't click the consent banner or open other pages.

This is not legal advice and does not replace a review by your data protection officer. It shows the points that can be proven from the outside. Data protection findings don't affect the grade, which measures the attack surface. For sites in the EU, tracking findings are warnings, otherwise notices.

Google Fonts from Google's servers

If your site loads fonts from fonts.googleapis.com or fonts.gstatic.com, every browser sends its IP address to Google. A Munich court ruled this unlawful in 2022 (LG München I, 3 O 17493/20), and many legal warnings followed. For German-language sites this is a warning, otherwise a notice. If the address only appears in the JavaScript files, it is always a notice: it may come from a library that never loads it.

How to fix it: Download the fonts and serve them yourself. In Next.js, next/font does this automatically; in Vite apps (Lovable, Bolt), use a Fontsource package:

npm install @fontsource/inter

// in main.tsx
import "@fontsource/inter/400.css";
import "@fontsource/inter/600.css";

Then remove the link or @import to fonts.googleapis.com from index.html and index.css.

Tracking before consent

Analytics and advertising may only run after visitors agree (Section 25 TDDDG, GDPR). We report two cases: the server already sets cookies such as _ga, _fbp or _gcl_au in its first response, or the site loads Google Analytics, the Meta Pixel, Hotjar, Clarity, TikTok, LinkedIn, Microsoft Ads or Pinterest and we find no consent tool. If the site only loads Google Tag Manager, it is a notice: it can manage consent itself through Consent Mode.

Scripts with type="text/plain" or attributes such as data-cookieconsent only run after consent, so we don't count them. Consent tools we recognize include Usercentrics, Cookiebot, OneTrust, Borlabs, Complianz, CookieYes, Klaro, consentmanager, CCM19 and Google Consent Mode.

How to fix it: Add a consent banner and load trackers only after consent. If your server sets tracking cookies itself, for example through server-side tagging, that has to wait for consent as well.

Embedded content

YouTube videos, Google Maps and Vimeo placed directly as an iframe load on page view and send the IP address and often cookies to the provider. A better way is a preview with a notice that loads the content only after a click. For YouTube there is also the youtube-nocookie.com address.

Legal notice and privacy policy

Commercial websites in Germany need an easy-to-find legal notice (Impressum, Section 5 DDG) and a privacy policy (Art. 13 GDPR). On German-language sites we look for links to both on the homepage. Pure JavaScript apps build their links in the browser, so we skip this check there to avoid false alarms.

Still have questions? Email us.