A GDPR scanner checks the homepage and all subpages of a website for potential data protection issues. It examines which cookies, trackers and external services are loaded, whether this is done with or without the users’ consent, and whether the services used are correctly listed in the privacy policy. Checking subpages is particularly important, as many services relevant to data protection are only integrated on product, blog or contact pages and remain undetected if only the homepage is analysed. The following sections answer the most important questions regarding the GDPR check of subpages.
Which subpages are covered by a GDPR scan?
During a comprehensive GDPR scan, all publicly accessible subpages of a website are automatically captured and checked by a web crawler. The crawler follows the website’s internal links and compiles a complete list of all URLs found. Typically, this includes not only the homepage but also product, category, blog, contact and legal notice pages.
Important to note: Not all pages are publicly accessible by default. Password-protected areas such as intranets, member portals or test servers can also be scanned using a specially configured login script. The login process is carried out automatically, ensuring that these pages can also be included in the audit.
The scope of the subpage scan has a direct impact on the validity of the audit. A website where only the homepage is checked can provide a significantly distorted picture of the actual data protection situation. Subpages, in particular, often contain embedded videos, map widgets or social media elements that transmit personal data without this being apparent on the homepage.
Which cookies and trackers does a GDPR scanner check for on subpages?
A GDPR scanner checks which cookies are set and which external services are loaded on subpages, distinguishing whether this occurs before or after a user interacts with the consent banner. It records both first-party cookies and third-party trackers such as Google Analytics, Facebook Pixel or embedded map services.
The analysis goes beyond simply identifying cookie names. A good website scanner enriches the data found with information from extensive databases: using the URL of the external service, it identifies the company behind it, its registered office and whether this is located within or outside the EU. The latter is particularly relevant for the assessment of transfers to third countries under Article 44 et seq. of the GDPR.
For each subpage, it is thus possible to trace which services are active there and how they are interdependent. For example, an embedded map service may automatically reload additional services that are not even mentioned in the privacy policy. Making these chains of dependency visible is a key added value of an automated GDPR website check.
How does a GDPR scanner assess the consent banner on subpages?
A GDPR scanner assesses the consent banner by detecting whether a consent management tool is in place and then simulating how the website behaves before and after clicking ‘Accept All’. If cookies or external services are loaded before this interaction takes place, the scanner flags this as a potential data protection issue.
However, there is an important limitation to bear in mind: the scanner is technically unable to determine whether a detected ‘Accept’ button actually triggers valid consent within the meaning of the GDPR. It merely distinguishes between the state before and after a user interaction. The report therefore refers, for the sake of simplicity, to loading ‘with’ or ‘without consent’, although technically speaking it is more accurate to refer to loading before or after a user interaction.
Common consent tools such as Usercentrics or Cookiebot are recognised on the basis of their characteristic features. If no consent tool is present, even though cookies and external services are being loaded, a corresponding warning is issued. The same applies if services are loaded without prior consent despite an active consent tool being in place. This check is carried out not only on the home page but on every subpage scanned, as the behaviour of the consent banner may vary from page to page.
What does a GDPR scanner check for in privacy policies and legal notices?
A GDPR scanner checks the privacy policy to see whether the external services and cookies actually found on the website are also listed there. To do this, it compares the list of services detected during the scan with the content of the privacy policy. Services that are active on the website but are missing from the privacy policy are flagged as potential gaps.
The check is carried out via text analysis: The scanner reads the content of the linked privacy policy and compares the names of the services found with the text of the document. Discrepancies may arise, for example if a service appears under a different name in the policy or if the privacy policy is split across several pages. Such results should therefore always be checked manually, as automated text comparisons are not always reliable.
If a new service is found on the website that was not previously included in the privacy policy, the policy should be updated accordingly. Conversely, services that are no longer used on the website should be removed from the privacy policy. A dynamic privacy policy generator can assist with this reconciliation by keeping the text up to date based on the latest scan results.
How does the check of subpages differ from that of the homepage?
The homepage is usually checked daily during a GDPR scan, whilst a full crawl of all subpages typically takes place once a month. In terms of content, the check of subpages is more comprehensive, as different or additional services are often active there than on the homepage.
The homepage often contains basic elements such as consent banners, embedded fonts or analytics scripts. Subpages, on the other hand, may contain specific functions that are only activated in certain contexts: an embedded YouTube video on a product page, a Google Maps widget on the contact page, or a live chat tool in the support section. These services are not detected during a scan of the homepage alone.
A full scan of subpages is therefore essential for a meaningful data protection audit. The scan report summarises the results for all subpages and allows you to see, for each individual page, which services were found there and whether they are correctly integrated into the data protection process. Individual subpages can also be rescanned manually if necessary, for example if specific changes have been made to them.
How often should subpages be monitored using a GDPR scanner?
Subpages should be scanned in full at least once a month, as the use of third-party services can change at any time due to updates, plug-in changes or content alterations. For websites with frequent changes or high data volumes, continuous monitoring with automatic notifications of relevant changes is recommended.
In practice, a one-off GDPR check is not sufficient to remain permanently up to date with the actual data protection situation. Websites are dynamic systems: a new theme, an updated plug-in or an embedded third-party form can result in services suddenly being loaded that were not previously present. Without regular monitoring, such changes often go unnoticed.
Ongoing monitoring is particularly important for data protection officers and agencies that manage several websites simultaneously. In such cases, manually checking all subpages at regular intervals is hardly feasible. Automated monitoring solutions that trigger a notification when changes occur help to maintain an overview and enable a timely response without having to repeat the entire audit process.
How decareto supports the auditing of subpages
At decareto, we have specifically developed our SaaS platform to make the comprehensive auditing of websites – including all subpages – as efficient and traceable as possible. We support data protection officers, law firms, agencies and compliance teams with the following features:
- Full subpage scan: Our web crawler automatically captures all publicly accessible subpages and checks for cookies, trackers and external services on every single page.
- Consent analysis: We detect common consent tools and simulate user behaviour before and after consent is given to identify which services are loaded without prior consent.
- Dependency visualisation: For each subpage, we show which services are active and which additional services they automatically reload, with or without consent.
- Automatic notifications: You will automatically receive an email whenever relevant changes occur on monitored websites, enabling you to respond promptly.
- Password-protected areas: On request, we configure login scripts to include protected areas such as intranets or test servers in the scan.
- Privacy policy generator: Based on the scan results, our generator creates tailor-made privacy policies in 24 languages and keeps them up to date.
- White-label reports: Data protection officers and service providers can share reports with their clients under their own logo.
- If you wish to systematically check your website for data protection vulnerabilities and monitor it on an ongoing basis, get started with decareto now and receive a comprehensive scan report for your website and all its subpages in just a few minutes.
