Free website check

Check what your website does before visitors choose

Give us a public web address. We load up to five of its pages in a browser, as a first-time visitor would, and email you what the site did before the visitor made a choice, with the provision of the DPDP Act or Rules each finding engages.

  • 48 hours We'll email your report within 48 hours.
  • No score Each finding says how settled the law behind it is.
  • 13 May 2027 When the provisions we check commence.

How it works

  1. You give us a web address

    Any public website, and the email address the report should go to.

  2. We visit it as a first-time visitor

    We load up to five of its public pages in a browser. On the consent banner we click reject, then accept, each on a fresh visit.

  3. You get the report by email

    What we saw, the provision each finding engages, how settled that reading is, and how to fix it.

How we choose the five pages

The address you give us is always the first page. We pick up to four more from the links on it, all on the same website:

  1. Your privacy notice, cookie policy, contact page, grievance page and terms, in that order, when a link names them in its text or its address. At most one of each.
  2. If there is room left, pages that look like they hold a form, such as a sign-up or enquiry page.
  3. Then other pages linked from the first one, in the order they appear.

We never load a page your robots.txt asks visitors like us to leave out, other than the address you gave us. If that rules out one of your policy pages, the report lists it as skipped. We never use a spare slot for a login, account, cart or checkout page, or for a file such as a PDF.

Five pages are usually enough for what this check looks at. Trackers and cookies tend to load on every page, a consent banner shows on the first visit, and the privacy details we look for sit on the policy pages. What five pages can miss is anything that appears only deeper in the site, such as a video embedded in one blog post, a chat widget on one page or a checkout form.

What the report can tell you

Each finding comes with what we saw, the provision it engages, how settled that reading is, and how to fix it. See the report for our own website.

Settled
The Act or the Rules expressly impose this duty, and what we saw bears directly on it.
Likely
A reasonable reading of the text, but it depends on a point the text does not settle: most often whether an online identifier is personal data, or whether a legitimate use covers the processing.
Open
Arguable. Reasonable lawyers could disagree, so we show it for you to raise with your lawyer, not as a gap.

Before a visitor chooses

  • Trackers load before the visitor makes a choice Likely
  • Identifiers are set before the visitor makes a choice Likely

The consent banner

  • Trackers still run after the visitor clicks reject Settled
  • Accept is on the first screen of the banner, reject is not Open
  • The banner treats continued browsing as consent Likely
  • We did not find a way to change or withdraw consent later Likely

Forms

  • A consent box on a form is ticked in advance Settled
  • Session recording runs on a page with a form Likely
  • A form sends personal data to another company's server Likely
  • A personal-data form is not protected by HTTPS Likely
  • A form puts personal data in the web address Likely

What your pages publish

  • We did not find a contact for privacy questions Settled
  • We did not find how to make a rights request Settled
  • We did not find a grievance response period of 90 days or less Likely
  • We did not find a mention of complaining to the Board Likely
  • We did not find how to withdraw consent Likely

For information only, with no finding attached, we also note:

  • Consent banner
  • Login and security cookies
  • Third-party services
  • Page languages
  • What we scanned
  • What accepting and rejecting changed

What we never do

  • No form sent

    We read how forms are built. We never type into a form or send one.

  • Banner clicks only

    We never log in. The only buttons we click are the consent banner's.

  • Five public pages

    At most five public pages, all on the same website.

  • Names, not values

    We note cookie, service and form field names, never cookie values or what is typed into a form, and keep no copies of your pages. Quotes are at most 25 words.

  • No score

    No score or grade. Each finding says how settled the law behind it is.

What a website check cannot see

  • Whether you process children's data. A scan cannot tell who your users are, so the duties on children's data, such as the ban on tracking children (S.9(3)), are not checked.
  • Your mobile app, logged-in areas and anything behind a form. We never log in or submit a form.
  • Text in languages other than English. We note which languages the pages declare, and do not flag an English-only notice.
  • Your contracts, records and internal processes, such as consent records, retention and personal data breach response.

This check is not legal advice. Its findings matter only if you are the Data Fiduciary for the processing, and the provisions it cites commence on 13 May 2027. Section and rule references are to the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025.