"Run a free compliance scan" is everywhere. But what do these tools actually test, what can they never see, and when do you need something more than a scan? This guide answers that honestly — including exactly what our own scanner checks and doesn't.
| Layer | What it covers | Automated? |
|---|---|---|
| Technical signals | HTTPS/HSTS, security headers, cookie banner presence, privacy policy links, tracking scripts | ✅ Fully |
| Behavioural checks | Cookies firing before consent, reject-button parity, third-party trackers | ⚠️ Partially (needs real browser) |
| Legal substance | Whether your policy text actually matches your data practices; records of consent; DPA filings | ❌ No tool can judge this |
Any scanner that claims to "make you GDPR compliant" with one click is overselling layer 3. A good scanner does layer 1 reliably, flags obvious layer-2 problems, and tells you clearly where automation ends.
Every failed check comes with a concrete fix — not "consult a professional", but the exact header to add or element to change.
Best for: a fast triage of the technical layer. Ten seconds per site, zero cost, no installation. Limitation: one snapshot of the homepage — subpages with their own trackers aren't crawled.
Best for: legal substance — policy wording, data-processing agreements, consent records, international transfers. Cost: typically €1,500–€10,000+. A sensible sequence is scan first, audit second: arrive at the consultant with the technical layer already clean.
Best for: large sites needing continuous crawling of thousands of pages. €200–€1,000+/month. Overkill for most SMBs, but the right answer at scale.
| You are… | Sensible setup |
|---|---|
| Freelancer / small business site | Free scan quarterly + generated policies (free document tools) |
| Agency managing client sites | Scan every client + documented reports (EUComply Pro, $79/yr) before handover |
| E-commerce / high traffic | Scans + generated docs + periodic human review of policy substance |
A free scan won't make you compliant, but it catches the specific technical failures behind most cookie-related complaints — missing banners, weak TLS, unreachable policies — in seconds and for nothing. That makes it the correct first step for any site, on any platform:
🛡️ Passed? Add a free compliance badge to your site — client trust plus a dofollow backlink.