Privacy audit
Checks the site against the privacy rules of the region it works in: GDPR and ePrivacy, UK GDPR, Russia's 152-FZ, CCPA/CPRA, LGPD and others — trackers, consent, cookies and the required documents.
Privacy law has become one of the most common reasons for fines and complaints against ordinary websites. Not because owners collect data on purpose, but because a typical site loads a dozen third-party scripts, sets cookies before anyone has agreed and links to a privacy policy copied from someone else's site years ago. A privacy audit shows what the site actually does with visitor data and compares it with what the rules of its region require.
Which rules apply
The first step is to determine where the site works. The audit looks at the domain zone, the language of the pages, the currency and contact details, and the location of the server. On that basis it chooses the yardstick:
- EU and EEA — the GDPR and the ePrivacy Directive: no analytics or advertising cookies before consent, refusing must be as easy as accepting, and a policy that names every recipient of the data;
- United Kingdom — UK GDPR and PECR, the same principles with their own regulator;
- Russia — Federal Law 152-FZ: notification of Roskomnadzor, storage of Russian citizens' data in Russia, a separate consent to processing and a published processing policy;
- USA — CCPA/CPRA in California and similar state laws: a "Do Not Sell or Share My Personal Information" link, respect for the Global Privacy Control signal, a list of data categories;
- Brazil, Canada, Switzerland and others — LGPD, PIPEDA, the revised FADP and their requirements for notices and consent.
A site aimed at several regions is checked against each of them, and the report says which requirement comes from which law. A rule that does not apply to the site is not shown as a violation, so the report does not frighten you with someone else's regulator.
What is checked on the pages
Trackers and third parties. The scanner opens the pages in a real browser and records every request to an outside service: analytics, advertising pixels, chat widgets, video players, maps, fonts, social buttons. For each one you see the company behind it, the country where it processes data and what it is usually used for. This is the list that the privacy policy must match.
Consent before tracking. The key question is not whether the site has a cookie banner, but what happens before the visitor clicks it. The audit records which cookies are set and which requests are sent on the very first visit, then refuses consent and checks again. If analytics still runs after "Decline", or the banner has no decline button at all, the report says so with evidence.
Cookies. Every cookie is listed with its domain, lifetime and purpose: necessary for the site, functional, analytics or advertising. Cookies with a lifetime of years, third-party cookies and cookies without the Secure and SameSite flags are marked separately.
Forms and data transfer. Contact, registration and checkout forms are checked for an HTTPS connection, a link to the policy and, where the region requires it, a separate consent checkbox that is not ticked in advance. Data sent to a foreign domain or over an unencrypted connection is reported.
Required documents. The audit looks for a privacy policy, a cookie policy, terms of use, an imprint (mandatory in Germany and Austria) and an accessibility statement where the European Accessibility Act applies. It checks that they are linked from every page, open without errors and are written in the language of the site.
What you get
The report gives a compliance score for each applicable law and a list of findings ordered by risk. Each finding names the requirement, the page where the problem was found, the evidence — a request, a cookie, a screenshot — and the fix: configure the consent mode of the analytics, move a script behind consent, add a missing section to the policy. The list of discovered trackers and cookies can be exported and used as the basis of the cookie table in the policy.
Important to know
The audit is a technical check, not legal advice. It shows what the site does and where this diverges from the usual reading of the rules, which is exactly what a lawyer or a data protection officer needs to start from. With regular monitoring, a newly added pixel or a broken consent banner after a release is noticed within a day, instead of in a complaint to the regulator.
Order this audit
Tell us the site address and what worries you. A specialist runs the audit, checks every finding by hand and sends you the report with a prioritised list of fixes.