Coverage and limits
Choose the scope your website needs.
Technical checks work across markets. Country selections add a focused checklist. Fine estimates exist only for reviewed packs. The website is available in English.
International technical checks
The GLOBAL option checks HTTPS, browser security headers, cookies and external requests observed before interaction, privacy notice discovery, forms, automated accessibility signals and unclassified external services.
These are technical observations. GLOBAL does not decide applicable law, assess the legality of international transfers or estimate fines. An unknown or ambiguous market stays in this technical mode.
Reviewed packs
Reviewed country pack. Illustrative fine ranges may appear.
United Kingdom: 32 registered checks. UK GDPR; PECR; DPA 2018.
Germany: 32 registered checks. DSGVO; TDDDG; DDG / Impressum.
Israel: 27 registered checks. Protection of Privacy Law; consumer rules.
EU/EEA GDPR checklist
EU/EEA GDPR checklist (no national fine estimate). Germany stays on its reviewed pack above. Shared checks cover cookies and third-party requests before a choice, privacy notice discovery, forms and security signals.
Markets: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Iceland, Liechtenstein, Norway. Each selection runs 11 checklist items specialised to that market.
Named statute observations
Named statute observations (no fine estimate).
Switzerland: FADP (Federal Act on Data Protection).
Brazil: LGPD (Lei Geral de Proteção de Dados).
Canada: PIPEDA (Quebec Law 25 may also apply — not assessed separately).
Australia: Privacy Act 1988 (Australian Privacy Principles).
New Zealand: Privacy Act 2020.
Japan: APPI (Act on the Protection of Personal Information).
South Korea: PIPA (Personal Information Protection Act).
Singapore: PDPA (Personal Data Protection Act).
India: DPDP Act 2023 (Digital Personal Data Protection Act).
United States: No single federal website privacy statute; state laws differ (CCPA/CPRA and others not fully assessed).
What a country choice means
You choose one pack per report. Automatic suggestions use domain, language and company signals; they cannot establish all laws applying to a business. A business may be subject to more than one market. Multi-market applicability analysis is not currently available.
What the scan can miss
The scan uses accessible public pages and a limited crawl budget. Login walls, geography, bot protection, banners, timeouts and dynamically loaded content can change the evidence. Internal processing, contracts, data-subject request handling and manual accessibility are outside an automated website scan.
Reading your findings
Pass means a rule found no issue in the available signals. Warn needs attention; fail means a configured rule condition fired and still needs an applicability check. Manual means automated evidence is insufficient. The score is a heuristic indicator, not legal certification or a probability of enforcement. Fine information appears only for reviewed packs and is illustrative context, not a prediction.