Check your website: cookies, accessibility and security. Measured like a visitor, with the fix for every point.
We open your website like a visitor and show every gap in consent, accessibility, security and email. If it sells, we go all the way into the checkout. For websites with visitors from the EU.
For every website and shop system, no access and no plugin needed. All integrations
of EU shops we checked load trackers before anyone consents.352 shops, 14 EU countries, October 2026
How the check works
- Enter your addressWe open the home page and subpages like a visitor, for a shop also a product page and the checkout.
- See every findingWhat loads, what is missing and exactly where. Right away and free.
- Fix it with the stepsSteps for your system and consent tool: free for 14 days, no credit card needed. After that we check again every week.
What you get
Every finding with what we saw and the evidence.
Example from a made-up shop:
Open points
Each point says what we measured. The fix for it is under Fixes.
Consent & cookies4 to fix1 note
Google Analytics 4 loads without consent
- What we measured
- The service loads before the consent banner is answered, and it set cookies. Seen at: www.google-analytics.com.
- EU reference
- Art. 5(3) Directive 2002/58/EC (ePrivacy)
Checkout & product pages8 notes
Order button without words like "order with obligation to pay"
- What we measured
- Labels of the order buttons: "Jetzt bestellen".
- EU reference
- Art. 8(2) Directive 2011/83/EU (Consumer Rights)
- Limitation
- We see only the cart and first checkout page. If the final button is one step further, that one counts.
Accessibility2 notes
No accessibility statement found
- What we measured
- We did not find an accessibility statement on your website.
- EU reference
- Art. 13(2) Directive (EU) 2019/882 (European Accessibility Act)
- Limitation
- Microenterprises providing services are exempt (fewer than 10 employees and at most EUR 2 million annual turnover or balance sheet). We cannot see that from outside; if it applies, this point does not.
Dark patterns1 note
4 possible dark patterns on 2 checked pages
- What we measured
- Found on home page (1 hit), cart/checkout (3 hits): countdown timer that restarts, pre-selected paid add-on, fee that appears only at checkout, shaming text on a decline button.
- EU reference
- Annex I No. 7 Directive 2005/29/EC, Art. 22 Directive 2011/83/EU
- Limitation
- A technical observation of patterns that can count as manipulative, not a legal assessment.
Data flows & servers2 notes
1 address we could not attribute to a provider
- What we measured
- Loaded from: cdn.example.invalid.
- Limitation
- Usually this is your own infrastructure or a CDN.
Other points1 note
Chat widget loaded: Tawk.to
- What we measured
- A chat widget is loaded on the page.
- EU reference
- Art. 50(1) Regulation (EU) 2024/1689 (AI Act)
- Limitation
- We cannot tell from outside whether the chat uses AI.
Then every week: an email when something changes
A plugin update loads a new tracker: you hear about it with the location. Otherwise you hear nothing from us.
Example for a made-up shop
beispiel-shop.at: 1 new point since the last check
We checked beispiel-shop.at again. Something was added since the last report.
New since the last check
No longer found
The report sits at a random address and is excluded from search engines. Only people with the link can see it.
Servers in the EU · Legal notice · Privacy · Unsubscribe
Why konformia?
A cookie banner is the setting, konformia the check afterwards: does your website really only load what the banner promises?
Built and run by Immanuel Schranz near Vienna. Servers in the EU. This site loads nothing from third parties. No legal advice. Legal notice
- We show where it comes from: plugin, theme, app or Tag Manager.
- Nothing is installed on your website: we check from outside, it does not get slower.
- One price per domain, however many pages or visitors.
16 checks for websites in the EU market
4 of them are for shops; they only show to someone who goes as far as the product page and checkout.
- Does a tracker load before consent?
- Accessibility: statement and purchase path
- Does the reject button really work?
- Unit price, shipping costs, delivery time
All 16 checks with reference: check, where it shows, basis
| Check | Where it shows | Basis |
|---|---|---|
| Does a tracker load before consent? | Home page and subpages | Art. 5(3) Directive 2002/58/EC (ePrivacy) |
| Accessibility: statement and purchase path | Home, category, product page, checkout + own page | Directive (EU) 2019/882 Art. 4 and 13, WCAG 2.1 AA |
| Does the reject button really work? | Home page, after a click on Reject | Art. 5(3) Directive 2002/58/EC (ePrivacy) |
| Unit price, shipping costs, delivery time | Only on the product page | Art. 3 Directive 98/6/EC, Art. 6(1) Directive 2011/83/EU |
| Order button label | Only in the checkout | Art. 8(2) Directive 2011/83/EU |
| “Withdraw from contract” button | Every page | Art. 11a Directive 2011/83/EU, since 19 June 2026 |
| Cancellation button for subscriptions | Every page, subscriptions only | § 312k BGB, Germany only |
| Dark patterns: countdowns, pre-ticked add-ons, late fees, changed cart contents | Home page, product page, checkout | Annex I No. 7 Directive 2005/29/EC, Art. 22 Directive 2011/83/EU |
| Pre-ticked consent boxes | Every form | Art. 4(11) GDPR |
| Which country the services keep their servers in | Name resolution (DNS), no page | Art. 44 GDPR |
| Trackers under your own address (CNAME cloaking) | Name resolution (DNS), no page | Art. 5(3) Directive 2002/58/EC, Art. 5 GDPR |
| Google Consent Mode, duplicate banners and tag managers | Home page | Art. 5(3) Directive 2002/58/EC (ePrivacy) |
| Visible keyboard focus and accessibility widgets (overlays) | Home page, with the Tab key | Directive (EU) 2019/882, WCAG 2.1 criterion 2.4.7 |
| Email sender (SPF, DKIM, DMARC) and certificate expiry | Name resolution (DNS) and connection | technical, no legal duty |
| Security headers, libraries with known vulnerabilities, session cookies | Home page | technical, no legal duty |
| Broken links and images | All visited pages | technical, no legal duty |
Checking once is free.
Checking every week costs.
The price depends on domains, not on pages.
| Feature | Free0 €14-day trial, no credit card | Your choiceWatchdogfrom 29 € / monthfrom 290 € / yearfrom 1 website | Your choiceAgencyfrom 99 € / monthfrom 990 € / yearup to 25 websites |
|---|---|---|---|
| Right away, without signing up: every finding with its location | included | included | included |
| The fix for each point, for your system and consent tool | in trial | included | included |
| Every check: consent, accessibility, checkout, email, security | included | included | included |
| Weekly check | in trial | included | included |
| Email for every new point to fix | in trial | included | included |
| Badge "continuously checked" for your own website | not included | included | included |
| Overview of all websites | not included | included | included |
| Weekly status email for all websites | not included | not included | included |
Final prices in euros, no VAT (small business scheme), no setup fee, cancel monthly.
Check your website for free · See everything included and the price calculator
For agencies
25 client websites in one plan, every report as a PDF for the client file. 99 € a month for 25 domains
FAQ
Does the scan work if my website is not in English or German?
Yes. The scan reads your website in its own language, in every official EU language: the reject button in the cookie banner and, for shops, shipping costs and delivery time, manufacturer details, the legal guarantee note, the order button with the wording of Art. 8(2) Directive 2011/83/EU and the withdrawal button with the wording of Art. 11a, each in your language. The report and the steps to fix are in English or German.
What does the scan check before cookie consent?
We measure which services load before consent. The yardstick for access to the device is Art. 5(3) of the ePrivacy Directive 2002/58/EC; whether an exemption applies has to be checked case by case.
Does konformia check my legal texts?
No. We do not check legal notice, privacy policy or terms; legal-text services and lawyers do that. We measure what your website does technically and say how to fix every point.
Does konformia replace my cookie banner?
No. Your banner collects consent. konformia measures independently whether it really blocks: which services load before consent and after “Reject”, and how to stop that in your banner tool.
Do I get personal help?
Yes. You do not write into an anonymous ticket portal but directly to the operator: short questions, answered with the concrete report in view.
What does the check cost?
The scan is free, once per domain and month, without an account and without payment details. Ongoing watching costs 29 euros a month for one domain (Watchdog) or 99 euros for 25 (Agency), with extra domains in between. A monthly plan cancels monthly, a yearly plan at the end of the paid year.
Can I check again right after a change?
You can start a new check yourself after changes. Within 24 hours you have as many manual checks as your plan has domains, and each domain can be checked manually at most once in 24 hours. Automatic checks do not count.
Will my report be public?
No. Your report sits at a random address, blocked for search engines. Only people with the link can see it.
My banner shows. Why does something still load?
Usually the service is added a second time: hard-coded in the theme, past the banner through pixel settings in the shop or CMS, or as a Tag Manager tag without a consent check. The report names the source of each service and the step in your banner tool.
Does konformia install anything on my website?
No. We check from outside like a visitor, so your website does not get slower. The plugin and the app are optional and only change what you switch on there yourself.
Does it cost more if my website has many pages?
No. The price is per domain, however many pages, products or visitors the website has. Cancel monthly, no extra charges, and the 14-day trial ends by itself.
Can I show that I check my website?
Yes. Your account keeps a check log with the date and result of every check. It shows that and what you checked, not that the website is lawful.
Does the scan see what my visitors see?
Some sites serve a checking tool different code than a browser. Before we report that something loads before consent, we therefore open the home page a second time like an ordinary browser. We never get around bot protection: blocked means blocked, and the report says so.
A check usually takes
under two minutes.
Free, no sign-up, no credit card.