EDPB Website Auditing Tool review

The European Data Protection Board published the Website Auditing Tool on 29 January 2024. It was developed by an external expert within the EDPB's Support Pool of Experts, and the EDPB page states that it is not produced by the EDPB itself. The code is published under the EUPL on code.europa.eu; version 3.0.1 was released on 28 September 2026.

The tool runs as a desktop application or as a self-hosted web version. Inside its own Chromium browser the auditor visits the website, interacts with the consent banner and saves scenarios such as "before consent" and "after consent"; recorded user flows can be replayed and pages can be swept from the sitemap. For each scenario the tool records cookies (in the browser, in the cache and in requests), localStorage, the domains contacted, beacons from the EasyPrivacy and Fanboy lists, HTTPS use and redirection, forms sent without encryption and, optionally, a TLS test, together with screenshots. The auditor tags every item as compliant, not compliant or to be defined and adds comments; reports are generated from templates as PDF, DOCX, XLSX or JSON. Knowledge bases that classify trackers can be edited, imported and exported, but none is included by default.

The tool makes no automatic legal decision, does not check privacy-policy content, imprints, e-shop duties or accessibility, and gives no fixing advice. Installers are unsigned, and the project advises downloading them only from code.europa.eu. The interface is available in English, German, Greek, Spanish, French and Italian.

Its older sibling, the EDPS Website Evidence Collector (code.europa.eu/EDPS/website-evidence-collector, version 4.5.0 of 30 September 2026), is a Node.js command-line tool that crawls a site without interacting with it and saves evidence as HTML, PDF, YAML, JSON and HAR; it suits automated runs better but reports only the state before consent and only in English. Both tools are free.