Technical GDPR Audit
€450
one-off, two to three weeks
- Cookies, consent, tracking, third parties
- Finding list with severity tiers
- Briefing for the legal texts
Technical GDPR check for your website Consent, cookies and tracking checked.
The technical layer reviewed end to end: which scripts fire when, which cookies get set, where data flows and how much of it is actually consented to.
Six layers checked, one fix list.
The review runs against the page as actually served, not against what the CMS claims is configured.
Cookie inventory
A complete inventory of first-party, third-party, persistent and session cookies, categorised by purpose, provider, lifetime and legal basis.
Consent flow
How consent is requested, stored, withdrawn and respected. Common faults: scripts firing before consent, no withdrawal route, nudged acceptance.
Tracking and analytics
Analytics, ad pixels, heatmaps and session recording checked for whether they sit cleanly behind consent and whether the data is usable at all.
Third-party services
Embedded maps, videos, fonts, chat widgets and form services. Every script that phones home from your domain is captured and assessed.
Data flows
Forms, lead capture, CRM and email integrations. Where data goes, who processes it and what the privacy policy has to disclose.
Legal frame as the benchmark
The review runs against GDPR Art. 5, 6 and 7, against § 25 TDDDG for access to terminal equipment storage, and against the requirements for third-country transfers.
What the audit delivers.
Two to three weeks, resulting in a report with severity tiers and concrete fixes.
Always included
- Cookie and third-party inventory as a table
- Finding list with a severity tier per item
- A concrete fix recommendation per finding
- Consent flow as-is against target state
- Data flow sketch for forms and CRM
- Briefing document for privacy policy and cookie policy
When needed
- We implement the fixes
- A re-check after implementation
- Referral to a data protection officer or specialist lawyer
- Review of further domains or language versions
Not included
- Legal advice
- Drafting of the legal texts
- Representation in warning-letter cases
- A certificate or seal
The failure patterns almost every audit finds.
None of these are theoretical. For each one the report states whether it can be fixed in a day or needs a change of provider.
Fonts loaded from third-party servers
Google Fonts and similar services loaded straight from the provider transmit the visitor IP address on every page view. Since a 2022 ruling by the Munich Regional Court (LG München I), this has been a documented warning-letter risk in Germany. The fix: self-host the font files.
Analytics before consent
GA4 or other tracking is loaded directly in the page head instead of through the consent layer. Every visitor is tracked before they can refuse, and the data cannot be used legally.
Maps and videos on page load
Embedded maps and videos set cookies and transmit IP addresses the moment the page loads. They belong behind consent or behind a placeholder that only loads on click.
A banner that does not block
The banner looks compliant but loads scripts before the accept click, or ignores withdrawal. Legally that equals having no banner at all. We also check that withdrawal can be reached from every page.
Details that do not match
The form sends to a private mailbox, the privacy policy names a different processor, the legal notice lists a third address. On top of that come missing mandatory details in the Impressum under § 5 DDG, which our free Impressum generator (German) checks in advance.
Scripts nobody owns
Pixels from old campaigns, test snippets from a tool that was replaced long ago, the chat widget of a discontinued provider. Each one keeps transmitting data without delivering any value.
On its own or paired with the SEO audit.
Many clients combine both, because the same templates are involved.
SEO Audit
€690
one-off, two to three weeks
- Technical, on-page, content, architecture
- Prioritised action list
- Works well alongside the GDPR audit
Strategy Call
€190
60 to 75 minutes, credited later
- Obvious risks at a glance
- Written action list
- Right when you want to start broader
Three signals that it does not fit.
A technical audit does not replace a legal review.
- You are looking for legal advice or finished legal texts. We deliver the technical facts your lawyer or data protection officer can work from efficiently.
- You need a seal for the website. An audit is a snapshot with a fix list, not a certificate.
- You want confirmation rather than change. If scripts fire before consent, that goes into the report.
Further reading.
- GDPR Mistakes on Websites: These 8 Issues Can Lead to Legal ActionThese 8 GDPR mistakes are common on SME websites and can trigger legal warnings. Directly, without legal jargon, with a clear explanation of the risk and what to do about it.
- BFSG Website Requirements in Germany 2026: Who Is AffectedSome providers sell panic, some letters feel intimidating, and many business owners do not even know whether their website is covered at all. This article sorts it out without the fear-based sales pitch: who is affected, which exemptions apply and what to do about a warning letter.
Patrick SosathFounder of seosath, responsible for strategy, code and SEO
From the first call to the reporting you deal with the same person. No hand-off to a junior team, no account management in between.
Common questions about the GDPR audit.
We are outside the EU. Does the GDPR apply to us?
As soon as you address visitors, customers or users in the EU and EEA, the GDPR applies regardless of where you are based. Most non-EU companies with European customers fall within its scope.
Is this legal advice?
No. We audit the technical implementation: cookies, consent flows, third-party scripts, tracking, data flows. We coordinate with your legal advisers on wording but do not replace them.
Will my tracking still work afterwards?
Yes. Properly consented tracking is more reliable than patchy tracking that fires before consent and produces data you cannot legally use anyway.
Do you implement the fixes as well?
On request, yes. Many clients implement themselves, others have the fixes delivered straight away. Both work, and the scope is set after the audit.
What does the technical GDPR audit cost?
The audit costs €450 net at a fixed price. You get a fix list with a priority per item; we price the implementation separately afterwards, by scope.
Send us the URL. We come back with a fixed scope.
If you would rather start broader, the strategy call is the right entry point. The obvious risks are covered there as part of the technical lens.
Reply within one working day. 60 to 75 minutes, €190, credited against your project fee.