Ott Ristikivi
Most websites have a cookie banner. Far fewer actually respect it.
In May 2025 I was laid off from Veriff after six years. There I was often pulled into compliance work: auditors, ISO standards, SOC 2. I planned to rest. I lasted about two weeks.
Sitting in the backyard, one thought kept coming back: companies put real effort into their product and their compliance, but nobody looks after the website. It's like a public toilet. Nobody cleans it, as long as it looks good and does its job: converts visitors and brings in sales.
A friend, a very good backend developer, built a first version in a few days. Ten people tested it behind closed doors. Nine understood the problem straight away. One CTO said he'd use it, but it should be free. None of them became a paying customer.
What the browser showed
When we started auditing real sites, I was surprised how bad it is. The banner is there and everything looks compliant. Open the network tab and analytics, ad pixels and embeds are already running before you click anything.
Why it usually takes three people
Doing this properly takes someone who knows GDPR and ePrivacy law, a product manager and an engineer. Most teams don't have all three. So someone ends up in the dev console, keeping their own cookie list and guessing which cookies are essential. SecureSpells does that part: cookies, embedded trackers and data sent outside the EU, each mapped to the article behind it.
One recent story
Recently I emailed an online shop I use myself. Their banner was there, but tracking started before anyone clicked. The next morning their marketing manager wrote back: fixed. I lost the sale. I'm still happy about it, because I shop there and the site is in better shape.
What a report should feel like
It shouldn't point fingers. Every finding comes with the GDPR or ePrivacy article behind it, so you learn something and know why it matters. I want you to feel it was worth more than you paid.
How we work
- Bootstrapped. No outside money.
- No paid rankings. We don't pay for "best tool" listings. If the work is good, it should show by itself.
- Real browser evidence. Every finding comes from what a real browser saw on your site, not from reading the page source.
Ott Ristikivi, founder of SecureSpells
