Watchdog
29 €a month
1 website
- checked every week
- email when something changes
- “Continuously checked” badge
Plus your domain's email settings, and for shops the path all the way into the checkout. For websites with visitors from the EU.
Your account after the first check

Sample shop. Every point opens its fix with the steps for your tool.
Most important point
Google Analytics 4 loads without consent
Fix: In Google Tag Manager, open the GA4 tag and set “Additional consent required” under Advanced settings.
14 days free, no credit card. Results in under two minutes, no access or plugin needed.
56 %
A banner that shows up does not hold anything back yet. We note every service and every cookie from the first request, then click “Reject” and measure again, confirmed with an ordinary browser.
57 %
load Google Fonts from Google’s servers before anyone consents. The fonts usually come with the theme, past the banner. The report shows the source and the fix, in the WordPress plugin with one click.
848 websites, 14 EU countries, November 2026, hits re-checked by hand. Method and numbers
Where a service comes from (plugin, theme, app or Tag Manager) and what to set in your consent tool.
Order button without words like “order with obligation to pay”quick fix
Label the last button before submitting the order unambiguously, for example “Order with obligation to pay” or “Buy now”.
Order with obligation to payto copy
Checked like a visitor, no access and no plugin:
If a plugin update loads a new tracker, you get an email with where it is and the fix.
Example for a made-up shop
We checked example-shop.eu again. Something was added since the last report.
New since the last check
No longer found
The report sits at a random address and is excluded from search engines. Only people with the link can see it.
4 of them only for shops, all the way into the checkout. Every plan includes all of them.
| Check | Where it shows | Basis |
|---|---|---|
| Does a tracker load before consent? | Home page and subpages | Art. 5(3) Directive 2002/58/EC (ePrivacy) |
| Accessibility: statement and purchase path | Home, category, product page, checkout + own page | Directive (EU) 2019/882 Art. 4 and 13, WCAG 2.1 AA |
| Does the reject button really work? | Home page, after a click on Reject | Art. 5(3) Directive 2002/58/EC (ePrivacy) |
| Unit price, shipping costs, delivery time | Only on the product page | Art. 3 Directive 98/6/EC, Art. 6(1) Directive 2011/83/EU |
| Order button label | Only in the checkout | Art. 8(2) Directive 2011/83/EU |
| “Withdraw from contract” button | Every page | Art. 11a Directive 2011/83/EU, since 19 June 2026 |
| Cancellation button for subscriptions | Every page, subscriptions only | § 312k BGB, Germany only |
| Dark patterns: countdowns, pre-ticked add-ons, late fees, changed cart contents | Home page, product page, checkout | Annex I No. 7 Directive 2005/29/EC, Art. 22 Directive 2011/83/EU |
| Pre-ticked consent boxes | Every form | Art. 4(11) GDPR |
| Which country the services keep their servers in | Name resolution (DNS), no page | Art. 44 GDPR |
| Trackers under your own address (CNAME cloaking) | Name resolution (DNS), no page | Art. 5(3) Directive 2002/58/EC, Art. 5 GDPR |
| Google Consent Mode, duplicate banners and tag managers | Home page | Art. 5(3) Directive 2002/58/EC (ePrivacy) |
| Visible keyboard focus and accessibility widgets (overlays) | Home page, with the Tab key | Directive (EU) 2019/882, WCAG 2.1 criterion 2.4.7 |
| Email sender (SPF, DKIM, DMARC) and certificate expiry | Name resolution (DNS) and connection | technical, no legal duty |
| Security headers, libraries with known vulnerabilities, session cookies | Home page | technical, no legal duty |
| Broken links and images | All visited pages | technical, no legal duty |
Every plan includes every check. The price depends on domains, not on pages.
29 €a month
1 website
99 €a month
25 client websites
I’m Immanuel Schranz, 25, a software engineer from near Vienna. During my computer science studies I first came across data protection, cookie consent and accessibility. Out of my own interest I wrote a small tool that checks what a website loads before you agree to its cookie banner. The result surprised me: many websites had a banner, and the trackers loaded anyway.
With every website I tested, new questions came up. Does “Reject” really work? Is the checkout accessible? Are the domain’s email settings correct? Step by step, the small tool became konformia, now with 16 checks and a fix for every finding.
I build and run konformia myself. The servers are in the EU, and I answer your emails personally.
Immanuel SchranzFounderhallo@konformia.at
Yes. The scan reads your website in its own language, in every official EU language: the reject button in the cookie banner and, for shops, shipping costs and delivery time, manufacturer details, the legal guarantee note, the order button with the wording of Art. 8(2) Directive 2011/83/EU and the withdrawal button with the wording of Art. 11a, each in your language. The report and the steps to fix are in English or German.
We measure which services load before consent. The yardstick for access to the device is Art. 5(3) of the ePrivacy Directive 2002/58/EC; whether an exemption applies has to be checked case by case.
No. We do not check legal notice, privacy policy or terms; legal-text services and lawyers do that. We measure what your website does technically and say how to fix every point.
No. Your banner collects consent. konformia measures independently whether it really blocks: which services load before consent and after “Reject”, and how to stop that in your banner tool.
Yes. You do not write into an anonymous ticket portal but directly to the operator: short questions, answered with the concrete report in view.
The check is free: your website and email address start a 14-day trial without payment details that ends by itself. Ongoing watching costs 29 euros a month for one domain (Watchdog) or 99 euros for 25 (Agency), with extra domains in between. A monthly plan cancels monthly, a yearly plan at the end of the paid year.
You can start a new check yourself after changes. Within 24 hours you have as many manual checks as your plan has domains, and each domain can be checked manually at most once in 24 hours. Automatic checks do not count.
No. The result is in your account, the report behind it at a random address blocked for search engines. Only you and people with your link can see it.
Your result lives in an account, and an account belongs to an address. You see it right away, without a password. The click in our confirmation email unlocks every fix, the PDF, checking again and the email on changes. Until then we send nothing but that one email, and the trial ends by itself after 14 days.
Usually the service is added a second time: hard-coded in the theme, past the banner through pixel settings in the shop or CMS, or as a Tag Manager tag without a consent check. The report names the source of each service and the step in your banner tool.
No. We check from outside like a visitor, so your website does not get slower. The plugin and the app are optional and only change what you switch on there yourself.
No. The price is per domain, however many pages, products or visitors the website has. Cancel monthly, no extra charges, and the 14-day trial ends by itself.
Yes. Your account keeps a check log with the date and result of every check. It shows that and what you checked, not that the website is lawful.
Some sites serve a checking tool different code than a browser. Before we report that something loads before consent, we therefore open the home page a second time like an ordinary browser. We never get around bot protection: blocked means blocked, and the report says so.
Free, no credit card. The trial ends by itself.