✓
Inform the visitor
Required — always

What actually happens when someone opens your website

Every action the browser performs, what the law requires for it, what happens if you didn't take care of it — and what a technical privacy scan sees.

Informing the visitor is required for every action. Always. Consent is required for every element that is not necessary for the site to work.
The visitor's IP address is personal data. Every company the browser sends it to is a recipient.
It all starts with the code your page delivers. That makes you the controller. Tools acting on your instructions are your processors; Meta, for its pixel, is a joint controller.

Necessary element: consent not required, disclosure is Non‑essential element: allowed only after valid consent As found: a violation

We don't check what the policy says.
We check what the browser does.

This presentation (texts, scheme, animation and code) is a copyrighted work whose rights are held by AA Innovations, varnostne tehnologije d.o.o. (Slovenian Copyright and Related Rights Act — ZASP, Art. 5). Any use outside this website — reproduction (Art. 23), distribution (Art. 24), making available to the public (Art. 32a) or adaptation (Art. 33) — requires the prior written permission of the rights holder (Art. 21 ZASP).

What happens
What the law requires
If you didn't take care of it
What the scan shows
Legal practice
    GDPRCompliantSite.com
    © 2026 AA Innovations, varnostne tehnologije d.o.o. · All rights reserved
    Use outside this website only with the rights holder's permission
    Use the buttons, or ← → on the keyboard.
    Space = auto‑play · F = fullscreen

    The animated scheme works best on a wider screen. The full step‑by‑step text is right below.

    Step by step, in text

    The same nine actions as in the scheme above — what happens, what the law requires, what happens if you skipped it, and what the scan shows.

    Step 01 · Page request

    The page request

    Consent not required — Necessary for the service — disclosure is required Inform the visitor: Required — always Consent: Not required (necessary for the service)
    What happensThe visitor's browser asks your server for the page. The request carries their IP address, browser type and the page they came from. Your server writes it to its log. This is the only traffic that passes through your server — every further connection the browser opens on its own.
    What the law requiresAn IP address is personal data (Art. 4(1) GDPR). This is already processing, and you are its controller. Because it is necessary to deliver the page (Art. 6(1)(b) and (f)), consent is not required. Disclosure is: what you log, why, and for how long (Art. 13).
    What the scan showsChecks whether the privacy policy describes server logs and retention. If not, drafts the missing section from what the site actually does.
    Legal practice
    • CJEU, Breyer (C‑582/14): even a dynamic IP address is personal data.
    • GDPR: undisclosed server logs — Art. 13, 5(1)(a); up to €20 m / 4 % of turnover (Art. 83(5)).
    Step 02 · Necessary cookie

    A cookie necessary for the site to work

    Consent not required — List it: name, purpose, duration Inform the visitor: Required — always Consent: Not required (the element is necessary for the service)
    What happensYour own domain sets a cookie the site cannot work without: the session, CSRF protection, the record of the visitor's own choice about elements.
    What the law requiresExemption under Art. 5(3) of the ePrivacy Directive: the cookie is necessary for the service the visitor explicitly asked for, so consent is not required. Disclosure remains required: every cookie must appear in the policy with its purpose and lifetime.
    What the scan showsReads every cookie set without any click by the visitor, classifies it against a knowledge base of more than 2,000 known cookies and flags those the policy does not list.
    Legal practice
    • WP29 Opinion 04/2012: when the exemption for necessary cookies applies.
    • EDPB Guidelines 5/2020 on consent.
    • GDPR: cookie missing from the policy — Art. 13, 5(1)(a); up to €20 m / 4 % (Art. 83(5)). (ePrivacy exempts it from consent, not from disclosure.)
    Step 03 · Analytics

    An analytics cookie — Google Analytics

    Set before consent — Consent is required — and must come first Inform the visitor: Required — always Consent: REQUIRED — before the element is placed
    What happensYour server sends only HTML with a <script> tag. Everything else the visitor's browser does directly with Google: loads gtag.js, writes the _ga cookie and sends Google the IP, the page and a visitor ID — before the consent dialog is even shown. Your server never sees that traffic.
    What the law requiresYour page placed the script, so for this processing you are the controller; Google is a recipient. The cookie is not necessary for the service, so consent is required, and required before it is set (ePrivacy 5(3)). Disclosure is required too: the cookie, Google as recipient, the transfer to the US and its legal basis (Art. 13(1)(e) and (f), Art. 44–49). Consent does not replace disclosure.
    What the scan showsScans the site twice: before the consent click and after it. A cookie that exists in the first pass was set without consent. There is no arguing with the timeline.
    Legal practice
    • CJEU, Planet49 (C‑673/17): consent before the cookie is set.
    • DSB (AT) and CNIL (FR), 2022: Google Analytics without safeguards is unlawful.
    • National ePrivacy law (Slovenia: ZEKom‑2 Art. 225(1) → Art. 301): €200–20,000 per infringement.
    • GDPR: transfer to the US and processing without a legal basis — Art. 6, 44–49; up to €20 m / 4 % (Art. 83(5)).
    Step 04 · Local storage

    Writing to local storage

    Consent is required — Same rule as for cookies Inform the visitor: Required — always Consent: REQUIRED — before writing
    What happensScripts write data into the browser's local storage: A/B test variants, a session‑replay ID, tracking state. The entry has no expiry and survives closing the browser.
    What the law requiresArt. 5(3) of the ePrivacy Directive covers any storing of information on the user's device, not only cookies. The test is the same: if the entry is not necessary for the service, consent is required. A tool provider acting on your instructions (e.g. session replay) is your processor: you need an Art. 28 contract and a mention in the policy. Disclosure is required in any case: what, why, how long.
    What the scan showsIn both passes it also reads local storage and session storage, not only cookies.
    Legal practice
    • EDPB Guidelines 2/2023: ePrivacy Art. 5(3) also covers local storage, pixels and fingerprinting.
    • National ePrivacy law (Slovenia: ZEKom‑2 Art. 225(1) → Art. 301): €200–20,000 per infringement.
    • GDPR: processor without a contract — Art. 28; up to €10 m / 2 % (Art. 83(4)); undisclosed — Art. 13; up to €20 m / 4 % (Art. 83(5)).
    Step 05 · Third‑party assets

    Fonts, video and maps served by third parties

    IP sent on page load — Before any dialog was shown Inform the visitor: Required — always Consent: REQUIRED — before the IP is sent
    What happensYour page tells the browser to fetch a font from Google, a player from YouTube, a map from Google Maps. Each such fetch sends the visitor's IP address to that company — on page load, before any dialog.
    What the law requiresThe request was triggered by a <link> or <iframe> tag on your page, so it is your processing. Passing an IP address to a third party needs a legal basis and prior information: every such company is a recipient in the policy (Art. 13(1)(e)). The element is not necessary for the service, so consent is required. The alternative: don't send the IP at all — self‑host fonts, load video and maps only after consent.
    What the scan showsRecords every connection the browser opens before the consent click, identifies the company on the other end and lists who received the IP address.
    Legal practice
    • LG München I, 3 O 17493/20 (Jan 2022): damages for a single Google Fonts request.
    • CJEU, Breyer (C‑582/14): an IP address is personal data.
    • GDPR: IP handed to a third party without a legal basis or disclosure — Art. 6, 13(1)(e), 44–49; up to €20 m / 4 % (Art. 83(5)). (No storage on the device — ePrivacy 5(3) does not apply.)
    Step 06 · Pixels & beacons

    Tracking pixels and beacons — Meta, Google Analytics

    Fired before consent — Consent required + joint controller Inform the visitor: Required — always Consent: REQUIRED — before it fires
    What happensAn invisible 1×1 image reports the visit to Meta; Google Analytics sends a /collect beacon on every page and every click. The page looks the same. The visitor's profile on the other end grows.
    What the law requiresYou embedded the pixel, so the disclosure is your duty, not Meta's. It is not necessary for the service, so consent is required — before it fires (ePrivacy 5(3)). For social‑media pixels you and the platform are joint controllers: this must be stated explicitly in the policy, together with the pixel, the platform as recipient and the purpose.
    What the scan showsDetects beacon and pixel requests by their destination pattern, files them under Advertising or Social media and checks whether they fire before the consent click.
    Legal practice
    • CJEU, Fashion ID (C‑40/17): embedding a Facebook element → joint controllership.
    • CJEU, Wirtschaftsakademie (C‑210/16): joint controllership with the platform.
    • National ePrivacy law (Slovenia: ZEKom‑2 Art. 225(1) → Art. 301): €200–20,000 per infringement.
    • GDPR: processing without a legal basis — Art. 6; up to €20 m / 4 % (Art. 83(5)); joint controllership undisclosed — Art. 26; up to €10 m / 2 % (Art. 83(4)).
    Step 07 · The other end

    What happens on the other end

    Profiling across sites — A purpose of its own Inform the visitor: Required — always Consent: REQUIRED — for this specific purpose
    What happensThe visitor ID from the _ga cookie and the _fbp value are the same on every site that uses Google or Meta. Each visit adds a line to one single profile: pages, time, device, interests. Your site is one of millions of sources feeding that profile.
    What the law requiresCross‑site tracking and profiling are a purpose of their own (Art. 4(4)). The policy must name it, together with the platform as recipient and the legal basis for the transfer. Consent must cover exactly this purpose — the word "analytics" does not describe an advertising profile (Art. 13(1)(c), Art. 6(1)(a)).
    What the scan showsAssigns each detected tracker its real purpose (Analytics, Advertising, Social media) by the destination of the request, not by what the banner calls it, and checks that the policy names that purpose.
    Legal practice
    • CJEU, Meta v Bundeskartellamt (C‑252/21): profiling needs consent for that purpose.
    • EDPB Guidelines 8/2020 on targeting of social media users.
    • GDPR: consent for the wrong purpose, profiling — Art. 6(1)(a), 13(1)(c), 44–49; up to €20 m / 4 % (Art. 83(5)).
    Step 08 · The dialog

    The consent dialog

    Must offer a real choice — Otherwise everything behind it is invalid Inform the visitor: Required — always Consent: Valid only if the choice is real and equal
    What happensA dialog asking for consent to non‑essential elements appears. Whether its result counts as consent depends only on how it is built, not on the fact that it exists.
    What the law requiresConsent must be freely given, specific, informed and unambiguous (Art. 4(11), Art. 7). The dialog must say who processes, for what, and link to the full policy. Rejecting must be as easy as accepting. No pre‑ticked boxes. Withdrawing must be as easy as consenting.
    What the scan showsFinds the dialog, checks whether an equal path to reject exists and measures what actually changes after each choice. A dialog that changes nothing is rated fake consent — red.
    Legal practice
    • CJEU, Planet49 (C‑673/17): no pre‑ticked boxes.
    • EDPB Guidelines 3/2022 on dark patterns.
    • CNIL (2022): refusing must be as easy as accepting — fines for Google and Facebook.
    • National ePrivacy law (Slovenia: ZEKom‑2 Art. 225(1) → Art. 301): €200–20,000 per infringement.
    • GDPR: void consent — Art. 7; up to €20 m / 4 % (Art. 83(5)).
    Step 09 · Privacy policy

    The privacy policy

    Must describe the real state — Text ≠ behaviour of the site is the finding Inform the visitor: Required — always Consent: Every consent rests on this text being true
    What happensThe policy describes what the site does. The browser has just shown what the site really does. The two rarely match.
    What the law requiresArt. 13: identity of the controller, purposes, legal bases, recipients and processors, transfers to third countries, retention, the individual's rights. Art. 5(1)(a): the text must be true for this site, not for some other one.
    What the scan showsBuilds the policy from the measured behaviour of the site: the list of recipients is the list of connections opened, the cookie table is the actual content of the browser. Reads the controller's identity from the site itself and never assumes it.
    Legal practice
    • WP29 Guidelines on transparency (WP260 rev.01).
    • CJEU, Planet49 (C‑673/17): the information must include duration and third‑party access.
    • GDPR: untrue information — Art. 12–13, 5(1)(a); up to €20 m / 4 % (Art. 83(5)).

    We don't check what the policy says.
    We check what the browser does.

    Scan before and after consentTwo full passes with a real browser. Whatever exists in the first pass happened without consent.
    Six consent categoriesFunctional, Analytics, Advertising, Social media, Fonts & visual assets, Other. Every finding belongs to one of them.
    Policy from measured behaviourRecipients, processors, cookies, storage, transfers — built from what the browser actually did, not from a template.
    Consent tool in 24 EU languagesEqual Accept / Reject buttons, nothing pre‑ticked, non‑essential elements are not loaded until the visitor chooses.
    Seal and rescansA dated record of what was found — and nothing more. Sites change, so the scan repeats.
    Disclosure checked for every actionNecessary or not, with consent or without — every action found is compared with the policy text. Nothing stays undisclosed.

    The scan measures the observable behaviour of the user‑facing part of the site at the time of scanning. It does not assess internal procedures, contracts or records of processing. The seal is not an accredited certification.

    This presentation (texts, scheme, animation and code) is a copyrighted work whose rights are held by AA Innovations, varnostne tehnologije d.o.o. (Slovenian Copyright and Related Rights Act — ZASP, Art. 5). Any use outside this website — reproduction (Art. 23), distribution (Art. 24), making available to the public (Art. 32a) or adaptation (Art. 33) — requires the prior written permission of the rights holder (Art. 21 ZASP).

    Check your website — free scan → One free scan per domain · No registration required