In many cases, a targeted technical audit can reveal whether a website is processing personal data unlawfully: cookies and external services loaded without a valid legal basis are the most common indicators. This affects almost all corporate websites that use analytics tools, advertising networks or embedded content. The following questions and answers show you exactly what you need to look out for and how to proceed systematically.
What types of data processing on websites are relevant to the GDPR?
Any processing of personal data is relevant to the GDPR – that is, any process in which information that can be attributed to a natural person is collected, stored, transmitted or analysed. On websites, this applies in particular to IP addresses, cookie content, user profiles and all data transmitted to external providers.
Specifically, the following categories fall under GDPR-relevant data processing:
Cookies and web storage: Both traditional cookies and local storage and session storage may contain personal data or contribute to the identification of users.
External services: If external services are loaded directly by the browser, the IP address is usually transmitted to the relevant server in the process. This applies, for example, to analytics tools, advertising networks, fonts (such as Google Fonts), social media buttons and embedded videos.
Contact and form fields: Any information entered by users into forms is subject to the GDPR, provided that the data is stored or passed on.
Server logs: Web servers automatically store IP addresses and timestamps every time a page is viewed, which also constitutes the processing of personal data.
Important to understand: The GDPR does not distinguish between whether data processing is technically necessary or commercially motivated. The only decisive factor is whether personal data is involved and whether there is a valid legal basis under Article 6 of the GDPR.
How can you tell if a website is processing data without a legal basis?
There may be indications of unlawful data processing if a website sets cookies requiring consent or loads external services before users have given their consent. The decisive factor is whether there is a valid legal basis under Article 6 of the GDPR for the processing of personal data. In practice, potential data protection breaches can be identified by several characteristics.
Cookies and services before consent
A key warning sign is the presence of tracking cookies or analytics services that are already active when the page is first loaded – that is, before the user has given their consent. Tracking-based advertising or analytics generally require prior consent. If cookies or services requiring consent are nevertheless activated immediately, this may constitute a data protection breach.
Missing or faulty consent banner
A consent banner that does not offer a genuine option to opt out, contains pre-ticked boxes or does not technically prevent services from starting before consent is given does not meet the GDPR requirements. Nor is a banner sufficient if it merely provides information without actually controlling data processing. You should therefore check not only whether a banner is present, but also its technical effectiveness.
Missing or incomplete privacy policy
If a website incorporates external services that are not mentioned in the privacy policy, this indicates a potential data protection breach. According to Article 13 of the GDPR, the privacy policy must, amongst other things, provide information on the recipients or categories of recipients of personal data, the legal bases and the retention period.
What technical methods help to find hidden trackers?
Hidden trackers can primarily be uncovered by analysing a website’s network traffic. This involves checking which external domains are contacted when a page loads, which cookies are set, and whether this occurs even before any user interaction takes place.
The following technical methods are used in practice:
- Browser developer tools: In the Network tab of modern browsers, you can observe in real time which requests a website makes. External domains contacted during the initial load are potential trackers.
- Cookie analysis: Via the Applications tab in the developer tools, you can view all cookies set, including their domains, expiry times and types. Third-party cookies should be assessed with particular caution.
- Automated website scanners: Specialised tools simulate a page view, record all network requests, cookies and loaded services, and assign these to known providers. Such a GDPR website check can deliver results in minutes that would take hours to verify manually.
- Analysis of the privacy policy: A comparison between the services actually loaded and the providers listed in the privacy policy reveals any gaps.
Please note: Not every unknown domain automatically constitutes a data protection issue. Sometimes images or static files are loaded from the company’s own servers with a different domain, which does not constitute third-party processing within the meaning of the GDPR. Careful evaluation of the results is therefore essential.
What are the most common GDPR breaches on corporate websites?
The most common GDPR breaches on corporate websites relate to the loading of tracking services without consent, faulty consent banners, and the integration of external services without sufficient documentation in the privacy policy. These issues occur regularly even on professionally maintained websites.
An overview of the most significant breaches:
Google Analytics without consent: Analytics services are often integrated in such a way that they collect data even before the user has given their consent. The use of Google Analytics generally requires prior consent, particularly due to the access to information on the end device in accordance with Section 25 of the TDDDG.
Google Fonts via remote embedding: The direct embedding of Google Fonts transmits the visitor’s IP address to Google servers. Without a sufficient legal basis, this may constitute a data protection breach. Anyone wishing to use Google Fonts should host the fonts locally. We explain the details in our blog post GDPR Check: Google Fonts – Checking Websites.
Pre-selected consent banners: Banners where tracking categories are enabled by default breach the GDPR’s consent requirement.Missing privacy policy or out-of-date content: If new services are integrated without updating the privacy policy, a gap arises between the actual processing and the documentation.Transfers to third countries without safeguards: If personal data is transferred to countries outside the European Economic Area, the requirements of Articles 44 et seq. of the GDPR must be met. In the absence of an adequacy decision or suitable safeguards, a transfer is only permitted under the strict conditions of the statutory exceptions.Embedded content without consent: YouTube videos, social media widgets or map services establish connections to external servers as soon as they are loaded, even without the user interacting with them.
How can a website be systematically checked for data protection breaches?
A systematic data protection audit of a website follows a structured process: first, all cookies and external services are identified; then their legal bases are assessed; next, consent management is reviewed; and finally, the privacy policy is reconciled with the actual processing activities.
A tried-and-tested audit procedure is as follows:
- Inventory of all services and cookies: Compile a comprehensive list of which external services are integrated and which cookies are set, both before and after a user interacts with the consent banner.
- Assessment of legal bases: Assign a legal basis under Article 6 of the GDPR to each service and each cookie. Advertising services always require consent; for other categories, a legitimate interest may be considered depending on the context.
- Review of consent management: Ensure that the consent banner is technically effective, i.e. that services requiring consent are only loaded once consent has been given.
- Reconciliation with the privacy policy: Compare the services identified with the providers listed in the privacy policy. Any missing or out-of-date entries must be updated.
- Review of transfers to third countries: Identify services whose providers are based outside the EU and check whether there are adequate safeguards in place for the data transfer.
- Regular review: Websites are constantly changing. New plugins, updates or changes to the code can integrate new services at any time. A one-off review is therefore not sufficient; ongoing monitoring is necessary.
For websites with many subpages or for service providers managing multiple client websites, it is advisable to use automated tools that can also cover password-protected areas and subpages. An automated GDPR check helps to identify vulnerabilities in a structured manner, but does not replace the final legal assessment by a qualified data protection officer.
What are the consequences for companies if they process data unlawfully on their website?
Companies that process personal data on their website without a valid legal basis risk facing administrative fines from data protection authorities, civil law warnings and reputational damage. The GDPR provides for severe sanctions, the amount of which depends, amongst other things, on the severity of the breach and the company’s turnover.
The key risks in detail:
Fines imposed by supervisory authorities: The data protection authorities of the EU Member States are authorised to impose fines. Article 83 of the GDPR provides for different ranges of fines depending on the nature of the infringement. The amounts that may be imposed in individual cases depend on many factors and cannot be predicted in general terms.
Warning letters from competitors and trade associations: Data protection breaches may also be relevant under competition law. Under certain circumstances, warning letters containing claims for an injunction and reimbursement of costs are possible, for example in the case of the unlawful integration of tracking services.
Claims for damages by data subjects: Article 82 of the GDPR grants data subjects the right to compensation if they have suffered damage as a result of a data protection breach. Claims for non-pecuniary damage may also be asserted.
Reputational damage: Data protection breaches that become public knowledge can cause lasting damage to the trust of customers and business partners.
Particularly important: ignorance does not automatically protect against sanctions. Organisations must ensure the lawfulness of the processing of personal data and be able to demonstrate compliance. Regularly checking your website helps to identify and minimise data protection risks at an early stage.
How decareto supports you with the GDPR audit of your website
Here at decareto, we have developed a SaaS platform that automatically scans websites for data protection vulnerabilities, highlighting precisely those issues that are often overlooked during manual checks. Our solution is aimed at data protection officers, law firms, agencies and compliance teams who wish to monitor multiple websites efficiently and in a verifiable manner.
Here’s exactly what our platform offers you:
- Automated GDPR website scans in minutes rather than hours, including subpages and password-protected areas
- Automated detection of cookies and external services, as well as alerts regarding potential data protection breaches and missing consents
- Consent banner check: We simulate user interactions to identify which services are loaded before and after consent is given
- Risk score and prioritised recommendations for action to address the most critical issues first
- Continuous monitoring with automatic email notifications in the event of relevant changes
- Privacy policy generator for tailor-made privacy policies in 24 languages, which are automatically cross-checked against the scan results
White-label functionality for external service providers who wish to deliver reports under their own logo
Data protection officers and compliance teams can typically reduce the effort involved in website audits by up to 90% using our platform. Please note: Our scans identify vulnerabilities and support your compliance work, but do not replace the final legal assessment by a qualified data protection officer or solicitor. Try decareto now and gain a structured overview of your website’s data protection status in just a few minutes: Get started for free now.
