beispiel-shop.at

How we checked39.9 s · checkout reached · 7 services loaded before any consent

1 home page, 1 category page, 2 product pages, 4 other pages, first checkout page · version read beispiel-shop.at, page language de-AT, fetched from Finland

Check complete in 39.9 s

When each service first sent data. We never accepted a cookie banner.

1. 8 pages opened
2. Accessibility checked on 4 pages
3. First checkout page reached
4. Banner tested after rejecting
5. Server locations not determined

• 0.6 sGoogle Fonts (CDN-Einbindung)
• 0.6 sGoogle Analytics 4
• 0.6 sGoogle Tag Manager
• 0.6 sStripe
• 0.6 sTawk.to
• 21.8 sPayPal
• 21.8 sKlarna

quick fix 3 of 18 points usually need just one line of text or one setting.

4 services load clearly before consent here. Across 222 Austrian web shops we checked (Oktober 2026) the median is 2, and 62 shops have none. That is more than half of the shops.

The findings in detail

We measure what your shop does technically and how to fix it. We do not check legal texts, and this is not legal advice.

8 to fix

Something we measured, with the fix. It does not say whether a legal duty is breached.

• 01

  Google Analytics 4: 2 to fix

  Google Analytics 4 loads without consent

  What we measured

  The service loads before the consent banner is answered, and it set cookies. Seen at: www.google-analytics.com.

  How to fix

  some work Load Google Analytics 4 only after consent. In your consent banner, assign the service to a category; the banner then blocks it until consent. In Google Tag Manager: set "Require additional consent" on the tag (Advanced Settings, Consent Settings). Equivalent services from the EU: Matomo (on your own server), Plausible Analytics (Estonia) or etracker (Germany).

  EU reference

  Art. 5(3) Directive 2002/58/EC (ePrivacy)

  Google Analytics 4 loads despite rejection

  What we measured

  After clicking "Nur notwendige" and measuring again, Google Analytics 4 still set cookies. Seen at: www.google-analytics.com.

  How to fix

  some work Rejecting must block the service. In your consent banner, assign the service to a category; the banner then blocks it until consent. In Google Tag Manager: set "Require additional consent" on the tag (Advanced Settings, Consent Settings). A common cause: the code is also placed directly in the theme. Equivalent services from the EU: Matomo (on your own server), Plausible Analytics (Estonia) or etracker (Germany).

  EU reference

  Art. 5(3) Directive 2002/58/EC (ePrivacy)

  www.google-analytics.com · _ga

• 02

  Google Fonts (CDN-Einbindung): 2 to fix

  Google Fonts (CDN) loads without consent

  What we measured

  The service loads before the consent banner is answered, and it connected to the provider, which receives at least your visitors' IP address. Seen at: fonts.googleapis.com.

  How to fix

  some work Simplest fix: host the fonts yourself (google-webfonts-helper, @font-face). In WordPress the OMGF plugin or the theme option "load Google Fonts locally" does this. Otherwise: Load Google Fonts (CDN) only after consent. In your consent banner, assign the service to a category; the banner then blocks it until consent.

  EU reference

  Art. 5(3) Directive 2002/58/EC (ePrivacy)

  Google Fonts (CDN) loads despite rejection

  What we measured

  After clicking "Nur notwendige" and measuring again, Google Fonts (CDN) still connected to the provider, which receives at least your visitors' IP address. Seen at: fonts.googleapis.com.

  How to fix

  some work Simplest fix: host the fonts yourself (google-webfonts-helper, @font-face). In WordPress the OMGF plugin or the theme option "load Google Fonts locally" does this. Otherwise: Rejecting must block the service. In your consent banner, assign the service to a category; the banner then blocks it until consent. A common cause: the code is also placed directly in the theme.

  EU reference

  Art. 5(3) Directive 2002/58/EC (ePrivacy)

  In a real report you download your fonts here as a ready package: font files, CSS and instructions for self-hosting.

  fonts.googleapis.com

• 03

  Meta Pixel: 2 to fix

  Meta Pixel loads without consent

  What we measured

  The service loads before the consent banner is answered, and it set cookies.

  How to fix

  some work Load Meta Pixel only after consent. In your consent banner, assign the service to a category; the banner then blocks it until consent. In Google Tag Manager: set "Require additional consent" on the tag (Advanced Settings, Consent Settings).

  EU reference

  Art. 5(3) Directive 2002/58/EC (ePrivacy)

  Meta Pixel loads despite rejection

  What we measured

  After clicking "Nur notwendige" and measuring again, Meta Pixel still set cookies.

  How to fix

  some work Rejecting must block the service. In your consent banner, assign the service to a category; the banner then blocks it until consent. In Google Tag Manager: set "Require additional consent" on the tag (Advanced Settings, Consent Settings). A common cause: the code is also placed directly in the theme.

  EU reference

  Art. 5(3) Directive 2002/58/EC (ePrivacy)

  _fbp · fbq

• 04

  Tawk.to: 2 to fix

  Tawk.to loads without consent

  What we measured

  The service loads before the consent banner is answered, and it connected to the provider, which receives at least your visitors' IP address. Seen at: embed.tawk.to.

  How to fix

  some work For chat widgets: load the widget only when someone clicks your own chat icon. Many providers have a delayed-loading setting; otherwise use the content blocker of your consent banner. Otherwise: Load Tawk.to only after consent. In your consent banner, assign the service to a category; the banner then blocks it until consent. Equivalent services from the EU: Crisp (France) or Smartsupp (Czech Republic).

  EU reference

  Art. 5(3) Directive 2002/58/EC (ePrivacy)

  Tawk.to loads despite rejection

  What we measured

  After clicking "Nur notwendige" and measuring again, Tawk.to still connected to the provider, which receives at least your visitors' IP address. Seen at: embed.tawk.to.

  How to fix

  some work For chat widgets: load the widget only when someone clicks your own chat icon. Many providers have a delayed-loading setting; otherwise use the content blocker of your consent banner. Otherwise: Rejecting must block the service. In your consent banner, assign the service to a category; the banner then blocks it until consent. A common cause: the code is also placed directly in the theme. Equivalent services from the EU: Crisp (France) or Smartsupp (Czech Republic).

  EU reference

  Art. 5(3) Directive 2002/58/EC (ePrivacy)

  embed.tawk.to

2 not checkable

Blocked or not loaded. Neither passed nor missing.

• 05

  Only cart and first checkout page checked

  What we measured

  We added an item to the cart and opened the first checkout page without choosing a country, shipping method or login. Anything that appears only after a further step was not visible to us.

• 06

  No US-specific checks yet

  What we measured

  The checks in this report follow EU law. Checks for the US (Global Privacy Control, "Do Not Sell or Share") are in progress; until then this report says nothing about US duties.

10 notes

Worth knowing, with the fix where there is one.

• 07

  No accessibility statement found

  What we measured

  We did not find an accessibility statement on your website.

  How to fix

  some work Publish an accessibility statement with the information required by Annex V of Directive (EU) 2019/882 as its own page and link it in the footer: which service, how it meets the requirements, and a contact option.

  EU reference

  Art. 13(2) Directive (EU) 2019/882 (European Accessibility Act)

  Limitation

  Microenterprises providing services are exempt (fewer than 10 employees and at most EUR 2 million annual turnover or balance sheet). We cannot see that from outside; if it applies, this point does not.

• 08

  3 automatically detectable barriers on 4 checked pages

  • Buttons must have discernible text (critical): Home page 1×
    • Home page: .icon-warenkorb
  • Images must have alternative text (critical): Product page 1×
    • Product page: <img src="./olivenoel.jpg" width="320" height="320">
  • Form elements must have labels (critical): Cart/checkout 1×
    • Cart/checkout: input[type="text"]

  This is what the list looks like with Watchdog; in a real first report this spot only says that it exists.

  Checked: Home page, Category page, Product page, Cart/checkout

  What we measured

  3 affected elements on home page (1 issue), product page (1 issue), cart/checkout (1 issue), tested against WCAG 2.1 A and AA with axe-core; only "serious" and "critical" counted.

  How to fix

  rebuild, usually with a developer Most of these are fixed in the theme or page builder: give images alternative text, form fields a visible label, icon buttons a name (aria-label), and make text darker or larger where contrast is too low. Then test again.

  EU reference

  Art. 4(3) and Annex I Directive (EU) 2019/882 (European Accessibility Act)

  Limitation

  Microenterprises are exempt under Art. 4(5). An automated test finds part of the requirements, never all; no hits does not mean "accessible".

• 09

  4 possible dark patterns on 2 checked pages

  • Ablauf-Timer, der beim Neuladen nicht weiterläuft (Home page): „00:10:00 → 00:09:59“
  • Vorangekreuzter bezahlpflichtiger Zusatz (Cart/checkout): „Versandversicherung (+1,50 €)“
  • Kostenposten, der erst an der Kasse auftaucht (Cart/checkout): „Servicegebühr“
  • Confirmshaming beim Ablehnen (Cart/checkout): „Nein, ich will nicht sparen“

  This is what the list looks like with Watchdog; in a real first report this spot only says that it exists.

  Checked: Home page, Cart/checkout

  What we measured

  Found on home page (1 hit), cart/checkout (3 hits): countdown timer that restarts, pre-selected paid add-on, fee that appears only at checkout, shaming text on a decline button.

  How to fix

  some work Use timers only with a real end date that keeps running on reload; leave boxes for paid add-ons unticked; show all fees on the product page or in the cart; claim scarcity only with real stock numbers; label decline buttons neutrally ("No, thanks").

  EU reference

  Annex I No. 7 Directive 2005/29/EC, Art. 22 Directive 2011/83/EU

  Limitation

  A technical observation of patterns that can count as manipulative, not a legal assessment.

• 10

  1 address we could not attribute to a provider

  What we measured

  Loaded from: cdn.example.invalid.

  How to fix

  some work Search your page source for each address to see which plugin, theme or service loads it. Remove integrations you no longer use. If it is a third-party provider, assign it to a category in your consent banner so it loads only after consent. Your own servers and CDN need none of this.

  Limitation

  Usually this is your own infrastructure or a CDN.

• 11

  Chat widget loaded: Tawk.to

  What we measured

  A chat widget is loaded on the page.

  How to fix

  quick fix If the chat uses AI: say so visibly in the chat window before the first answer, for example in the greeting. The setting is in your chat tool.

  EU reference

  Art. 50(1) Regulation (EU) 2024/1689 (AI Act)

  Limitation

  We cannot tell from outside whether the chat uses AI.

  embed.tawk.to

• 12

  2 links or images lead nowhere

  What we measured

  Image https://beispiel-shop.at/pixel.gif (404) on https://beispiel-shop.at/; Image https://beispiel-shop.at/olivenoel.jpg (404) on https://beispiel-shop.at/produkt-olivenoel.html.

  How to fix

  some work On the page named, change the link to the right address or remove it; upload the image again or take it out of the content. If the page moved, set up a redirect (301) from the old to the new address with your host or in your shop system.

  Limitation

  Up to 20 links to your own domain and 20 images on the pages visited were checked. Only a 404 or 410 response counts; blocked or slow addresses are not counted as broken.

• 13

  Order button without words like "order with obligation to pay"

  What we measured

  Labels of the order buttons: "Jetzt bestellen".

  How to fix

  quick fix Label the last button before submitting the order unambiguously, for example "Order with obligation to pay" or "Buy now". In WooCommerce and Shopify this is the translation of the order button in the theme or under Edit languages.

  EU reference

  Art. 8(2) Directive 2011/83/EU (Consumer Rights)

  Limitation

  We see only the cart and first checkout page. If the final button is one step further, that one counts.

  Checked in the checkout: /kasse, buttons there: „Einlösen“, „Jetzt bestellen“

• 14

  No "withdraw from contract" button found

  What we measured

  On the pages we opened without logging in, there was no button to withdraw from the contract.

  How to fix

  rebuild, usually with a developer Offer a clearly labelled "Withdraw from contract" button in the customer account and for guest orders. It leads to a form (name, order, contact) with a confirmation button, followed by an email acknowledging receipt. WooCommerce and Shopify have plugins and apps for this.

  EU reference

  Art. 11a Directive 2011/83/EU (Consumer Rights) (inserted by Directive (EU) 2023/2673), since 19 June 2026

  Limitation

  The withdrawal period starts only after an order, so the function may sit in the customer account, which we cannot reach. If it is there, this point is done.

  Checked in the checkout: /kasse, buttons there: „Einlösen“, „Jetzt bestellen“

• 15

  1 pre-ticked consent box

  What we measured

  Already ticked when the page loads: "Ja, ich bin mit dem Empfang von Werbung per E-Mail einverstanden.".

  How to fix

  quick fix Leave every consent box unticked by default, in the theme or in the form plugin's field settings.

  EU reference

  Art. 4(11) GDPR; CJEU C-673/17 (Planet49)

  Limitation

  Applies to boxes that ask for consent.

  Page: home page („Ja, ich bin mit dem Empfang von Werbung per E-Mail einverstanden.“)

• 16

  No manufacturer details on the product page (1 of 2 product pages)

  What we measured

  On these product pages we found no labelled manufacturer details.

  How to fix

  rebuild, usually with a developer Show the manufacturer's name, postal address and email on the product page itself (for manufacturers outside the EU also the responsible person in the Union), for example as a product attribute or a block in the product template.

  EU reference

  Art. 19 Regulation (EU) 2023/988 (GPSR)

  Limitation

  We look for labelled manufacturer details; a manufacturer named without a label is reported here wrongly. Services and digital content are not covered.

  Page: /produkt-olivenoel.html

4 confirmed

Loaded, nothing to do.

• 17

  Google Tag Manager loaded

  What we measured

  May load without consent, nothing to do.

  www.googletagmanager.com

• 18

  Klarna loaded

  What we measured

  May load without consent, nothing to do.

  js.klarna.com

• 19

  PayPal loaded

  What we measured

  May load without consent, nothing to do.

  www.paypal.com · www.paypalobjects.com

• 20

  Stripe loaded

  What we measured

  May load without consent, nothing to do.

  js.stripe.com · Stripe

How we saw it

Where we looked. So you can see whether it was the right place.

Info pages read

Document	Address	Text
Legal notice	beispiel-shop.at/impressum.html	617 characters