Compliance & Cookies Scanner

How this check works

Scanaris runs two tests on your page's HTML, both deliberately generous to avoid false positives. First: it looks for any link whose destination or text contains words such as privacy, cookies, legal notice, aviso legal, Datenschutz, RGPD, GDPR, terms, términos or condiciones, in several languages. If it finds none at all, it opens a medium-severity finding: the signal that there is no legal page is strong. Second: if your server's response sets cookies (a Set-Cookie header) and the HTML shows no known consent platform (Cookiebot, OneTrust, Osano, iubenda, Didomi, Usercentrics, Termly, CookieYes, Complianz, Borlabs, Klaro, tarteaucitron and some twenty more) nor the typical banner texts ("we use cookies", "accept cookies", "cookie policy"), it opens a low-severity finding. Low because many banners are loaded by JavaScript and are not in the initial HTML; the finding itself says so.

Why it matters

In the European Union, and in a growing number of countries, processing personal data requires telling people who processes it, for what and for how long: that is the privacy policy, and a contact form, a sign-up or an analytics tool already count as data processing. The cookie rules add that non-essential ones (analytics, advertising, social media) may only be set with prior, informed, revocable consent. The fines are real and data protection authorities impose them on small companies too, usually after a user complaint. But the most practical reason is trust: a site with no legal notice or privacy policy looks abandoned or unserious, and business customers check before paying.

How to fix it

Privacy policy and legal notice

• What to include: who you are (name, tax ID, address, email), which data you collect and for what purpose, on which legal basis, who you share it with (your host, your email provider, your analytics), how long you keep it, how to exercise access and deletion rights, and whether there are transfers outside the EU.
• How: a policy generator gives you a base; adapt it to what you actually do. A /privacy page and a /legal or /terms page, linked from the footer of every page.

Cookie consent

• First, an inventory: which cookies you set and which are essential (session, cart, the consent preference itself) and which are not (Google Analytics, ad pixels, embedded videos).
• If you only use essential ones, you do not need a banner; you do need a cookie policy that says so.
• If you use non-essential ones, a consent manager that blocks them until the user accepts, with "reject" as visible as "accept". Cookiebot, iubenda, Termly or CookieYes to start; Complianz or Borlabs on WordPress. If you use Google Analytics or Ads, configure consent mode so it respects the choice.
• Load the banner in the initial HTML or with a script in the <head>, not deferred: that way it appears before the cookies and this check also detects it.

Check it is fixed

curl -s https://yourdomain.com | grep -oiE '<a[^>]*href="[^"]*(privac|legal|cookie|terms)[^"]*"[^>]*>'
curl -sI https://yourdomain.com | grep -i set-cookie
curl -s https://yourdomain.com | grep -ioE "cookiebot|onetrust|iubenda|usercentrics|cookieyes|termly|complianz|we use cookies|accept cookies" | head -3

The first should show at least one legal link. If the second shows cookies, the third should show your consent manager.

Frequently asked questions

My site is a personal non-profit project. Does this still apply?

If you collect other people's data (a form, a sign-up, analytics), yes. If it is a static page with no forms and no analytics, you are not processing personal data and a notice of who you are is enough. But most "nothing on it" sites carry Google Analytics.

I have the banner but the finding still appears.

It is probably loaded by JavaScript after the HTML arrives, and this check does not run JavaScript. The finding is low severity precisely for that reason. If your banner works and blocks cookies until accepted, you can mark it as accepted; better still, load the manager's script in the <head>.

Do session cookies need consent?

No: those strictly necessary for the service to work are exempt. But they do need to be configured properly, which is what insecure cookies looks at. The rest of the legal and technical pre-launch list is in the checklist before launching.