SecureSpells

    Your cookie banner says no.Your website says yes.

    SecureSpells is an automated GDPR and ePrivacy compliance auditor for websites.

    We open your site the way a first-time visitor does, in a real browser in the EU, and record every cookie and tracker that loads before they choose and after they click Reject. Each finding names the GDPR or ePrivacy article it relates to.

    By running an audit you confirm you have authorization to test this site and accept our Terms and Privacy Policy.

    Free. No signup.

    • EU-hosted, Estonian company
    • Mapped to GDPR and ePrivacy articles
    • A report you can forward to your lawyer or DPO

    Not your own site?For legal teamsFor agencies

    Real result · domain withheld

    European travel commerce site

    Severe risk
    Cookies set when the page opened
    9
    Cookie banner shown
    Yes, OneTrust
    Cookies removed after clicking Reject
    0

    What this means

    The Reject button did nothing. Nine cookies before the choice, nine after.

    Relevant lawGDPR Art. 6(1)(a)GDPR Art. 7
    8 of 39 checks failedRisk 5.0 of 5
    What you get

    Evidence, not just a warning

    Every finding shows what we tested, what we saw and which article it relates to. A lawyer can check it. A developer can fix it.

    • Cookies, requests and timestamps recorded by the browser
    • The method and its limits, written into every report
    • Fix steps your developer can follow
    See a full sample report →
    High

    The Reject button does not work

    Real result · domain withheld

    Before any choice

    9

    cookies

    After clicking Reject

    9

    cookies

    Removed

    0

    cookies

    What we tested
    A first-time visitor opens the page, then clicks Reject on the OneTrust banner.
    What we saw
    Nine cookies were present before any consent choice. After the reject control was clicked, nine remained and none were removed. Five were unclassified rather than confirmed as essential.
    Relevant law
    GDPR Art. 6(1)(a)GDPR Art. 7
    Our limits
    One automated visit. Accepting all cookies is not simulated. Findings support, but do not replace, a legal assessment.
    Check: cookies_after_rejectEngine v2.9
    How it works

    A cookie banner can look right and still not work

    We test what your website actually does, before a visitor makes a choice and after they click Reject.

    1. Step 1

      We visit like a new visitor

      A real browser in the EU opens your site with no history and no prior consent.

    2. Step 2

      We record what loads

      Every cookie, script and network request before consent and after Reject, with UTC timestamps.

    3. Step 3

      You get an evidence-backed report

      Each problem in plain English, with the evidence, the article it relates to and how to fix it.

    Who it's for

    Start with the job in front of you

    Lawyers, DPOs and auditors

    Attach proof to your opinion

    Timestamped evidence of what a site did, mapped to GDPR and ePrivacy articles, ready to add as an annex.

    Auditor Workbench and white-label reports are part of Agency Workspace.

    See how the evidence report works →

    Agencies

    Hand over sites with proof

    White-label reports at launch, then daily checks that show when a new tag breaks consent on a client site.

    Explore the agency workspace →

    Website owners

    Check your own site today

    A free audit now, and a full report with fixes your developer can follow when you need it.

    Run a free audit
    Real decisions

    Regulators fine the failures we test for

    Not only big tech. Each case links to the regulator's decision or a named legal source.

    • ANSPDCP · Romania2025

      5,000 lei (about €985)

      Coral Travel & Tourism Services

      A regional travel agency stored non-essential cookies and tracking modules before visitors had consented.

      Our check: Cookies before consent

      Read the decision →
    • AEPD · Spain2024

      €30,000

      Iberia

      Visitors searching for a flight were given no option to reject cookies and were told they had to accept to continue. Upheld on appeal.

      Our check: No reject option

      Read the decision →
    • AEPD · Spain2023

      €90,000

      Techpump Solutions

      Third-party cookies stayed active after the visitor clicked reject all. Offering a reject button is not enough if the site keeps collecting.

      Our check: Cookies after Reject

      Read the decision →
    Ott Ristikivi

    Evidence you can inspect. A person accountable for the product.

    The risk score method is published. Every report lists what the scan did and what it could not do. We build the runtime scanner, the check engine, the risk scoring model and the GDPR article mapping in house. Not a reseller of somebody else's scanner, and not a team you will never speak to.

    “I launched SecureSpells because static HTML scrapers keep missing the scripts that actually trigger regulatory fines.”

    “We treat privacy compliance like a network-level unit test, monitoring real browser execution so you get actual legal evidence, not a vague score.”

    Ott Ristikivi · Founder & CEO of SecureSpellsHow the risk score worksBook a callLinkedInott@securespells.com

    We scan our own site too

    2.85of 5Moderate risk

    securespells.com scores 2.85 of 5, Moderate, across 35 checks. It passes the cookies-before-consent check. Not a perfect score, and we publish it anyway.

    Pricing

    One check, ongoing monitoring, or a whole client portfolio

    Every paid plan runs the full GDPR and ePrivacy audit. Cancel a subscription any time from Billing.

    Looking for a quick baseline check of a single site? Run a free audit

    Loading pricing card
    Loading pricing card
    Loading pricing card

    Custom and enterprise

    More than 5 reusable slots, custom monitoring intervals or an SLA? We quote around your team's delivery workflow.

    Ask for a quote

    First-audit guarantee

    If your first paid audit finds nothing beyond what the free scan on this page already showed you, we refund it.

    Run the free scan first, then compare it against the paid report. If the paid one surfaces no finding the free one missed, tell us within 14 days and the payment comes back. Applies to the one-off report and to the first month of a new subscription. No forms and no argument.

    Questions

    The questions agencies actually ask

    Including the ones where the honest answer is not the flattering one.

    Find out what your website does before a regulator does

    Free. No signup.

    By running an audit you confirm you have authorization to test this site and accept our Terms and Privacy Policy.

    Prefer to look first?