What a website compliance check should cover in the EU

“Is our website compliant?” sounds like one question. In the EU it is at least six, governed by different legal acts with different enforcers: data-protection authorities for cookies and privacy notices, consumer-protection bodies for shop information, and market-surveillance authorities for accessibility. A good compliance check, whether you run it yourself or buy a scanner, should cover all of them and tell you which rule each finding comes from.

1. Cookies, storage and consent

Article 5(3) of the ePrivacy Directive requires consent before information is stored on, or read from, a visitor’s device, unless it is strictly necessary for the service the visitor explicitly requested. The rule covers cookies, but also local storage, pixels and fingerprinting techniques. The standard of consent is the GDPR one: freely given, specific, informed and unambiguous (GDPR Articles 4(11) and 7).

A check should therefore:

• load the site in a clean browser without interacting and record every cookie, storage entry and network request that appears before any choice is made;
• repeat the visit after clicking “reject” and confirm that non-essential trackers stay off;
• verify that rejecting is as easy as accepting, that no option is pre-selected, and that consent can be withdrawn as easily as it was given (GDPR Article 7(3));
• compare what the banner and cookie list claim with what actually loads.

Our separate guide, Cookie consent: what the ePrivacy rules require, goes into the details.

2. Third-party requests and data transfers

Every embedded font, video, map, chat widget or analytics tag sends the visitor’s IP address and browser details to another company. Under the GDPR that is a transfer of personal data that needs a legal basis (Article 6) and, if the recipient is outside the EEA, a transfer mechanism under Chapter V. The Court of Justice held in Fashion ID (C-40/17) that a site operator embedding a third-party plugin can be a joint controller for the collection and transmission of visitor data.

A scanner should list each third-party host the page contacts, when it contacts it (before or after consent) and, ideally, where the recipient is established. Self-hosting fonts and scripts is the simplest fix for many findings.

3. The privacy notice

GDPR Articles 13 and 14 list what visitors must be told: who the controller is and how to contact them (and the data protection officer, where one is appointed), the purposes and legal bases of each processing activity, recipients, transfers outside the EEA, retention periods, the data-subject rights, the right to complain to a supervisory authority, and whether automated decision-making is used. Article 12 adds that the information must be concise, transparent and easy to access.

Automated tools can confirm that a notice exists, is linked from every page and mentions the required elements. Whether the content matches what the site actually does is the part that matters most, and the part a scanner can only approximate by comparing the notice with the trackers it found.

4. Provider information (“imprint”)

Article 5 of the e-Commerce Directive requires every information-society service to make certain details “easily, directly and permanently accessible”: the provider’s name, geographic address, contact details including an e-mail address, trade-register entry and number, VAT identification number, and the supervisory authority or professional rules where relevant. Several Member States implement this as a dedicated imprint page (Germany’s § 5 DDG, Austria’s § 5 ECG, Slovakia’s Act No. 22/2004 Coll.).

A check should confirm that the page exists, is reachable within one or two clicks from every page and contains each element. More detail: Imprint and consumer-law information duties for EU online shops.

5. Consumer-law information for shops

If the site sells to consumers, the Consumer Rights Directive adds pre-contractual information (Article 6), the order-button wording (Article 8(2)) and the 14-day right of withdrawal (Article 9). Since the Omnibus Directive 2019/2161, shops must also explain how product rankings are determined, state whether and how they verify consumer reviews, and show the prior price when announcing a reduction (Price Indication Directive, Article 6a).

6. Accessibility

Since 28 June 2025 the European Accessibility Act applies to consumer-facing e-commerce and several other services. In practice that means meeting the web requirements of EN 301 549, which references WCAG 2.1 level AA. Automated testing reliably finds missing alternative text, insufficient contrast, unlabelled form fields and missing language attributes; keyboard operation and screen-reader flow still need manual testing. See Accessibility (EAA 2025) for websites.

A one-page checklist

What no scanner can see

Records of processing (GDPR Article 30), processor agreements (Article 28), data-protection impact assessments (Article 35), server-side tracking and what happens inside logged-in areas are invisible to a crawler. A scan is the best first step and an excellent regression test; it is not a full audit. Our guide What automated compliance scanners can and cannot check explains where the line runs.