Consent banners define the rules. Runtime verification proves they're followed. Run a 40-second runtime scan to catch tracking scripts and cookies firing behind your banner.
By running this scan, you confirm you are authorized to audit this domain and agree to our Terms of Service and Privacy Policy.
Free. No signup required. Full browser audit ready in few minutes.
CMPs define consent rules, but they do not monitor runtime network requests. SecureSpells watches what actually executes.
Measured by the SecureSpells engine on a rolling window.
A GTM container update ships trackers the launch audit never saw.
Third-party domains appear after a CMS or plugin update - often unlisted in the policy.
The control looks compliant; cookies and scripts keep running after refuse.
A single visitor reporting a pre-consent tracking leak obligates authorities to investigate. Regulators do not stop at the website: a public script leak opens your entire company to months of intrusive GDPR auditing, vendor reviews, and forced system redesigns.
A real browser, cold profile, and an evidence report you can hand to someone who did not run the scan.
Automated behavioural audit in a real EU browser, cold profile, no prior consent.
100+ evidence-backed ePrivacy and GDPR checks against what actually executed.
An evidence report with article mapping and concrete remediation steps.
Whether you are answering to a client, a regulator, or a board, opinion is not enough. SecureSpells delivers timestamped execution logs, network captures, and GDPR article mapping - 100+ evidence-backed checks on what actually ran.
An unrecognised third party host was contacted at runtime alongside adtech and CMP infrastructure. Domains outside the known vendor list cannot be assessed for purpose or transfer basis.
check: unlisted_third_party_domains · criticality 5 of 5
Nine cookies were present before any consent choice. After the reject control was clicked, nine remained and none were removed. Five were unclassified rather than confirmed as essential.
check: cookies_after_reject · criticality 4 of 5
Tracking requests were observed to hosts outside the EEA, which engages transfer obligations separately from the consent question.
check: cross_border_tracking_detected · criticality 4 of 5
pagead2.googlesyndication.com was observed during the crawl. The engine notes this check alone does not prove pre-consent execution and must be read against the timeline checks.
check: known_trackers_loaded · criticality 3 of 5
Banner detectors and static analysis can confirm a CMP is present. They cannot prove what fired in the milliseconds before consent.
| Capability | HTML / banner scanners | SecureSpells |
|---|---|---|
| Static / HTML analysis | Yes | No |
| Detects that a cookie banner exists | Yes | Yes |
| Sees runtime behaviour before consent | No | Yes |
| Timestamped network and cookie timeline | No | Yes |
| GDPR / ePrivacy article mapping | No | Yes |
Pick the job in front of you - not a persona label.
One-off audit for an immediate launch, update, or concern.
Deliverable: Free runtime scan plus a path to a full evidence report with 100+ evidence-backed checks and developer remediation guidance.
Run Free Audit →Attach legal-grade, timestamped proof to formal opinions or DPIA reviews.
Deliverable: Annex-ready evidence packs, GDPR article mapping, and runtime network context counsel can cite.
Explore Legal & Audit Workflows →Hand off launch proof to protect liability and monitor sites for tag regressions.
Deliverable: White-label PDF exports, reusable delivery capacity, and automated change alerts.
Explore Multi-Site Workflows →Raw logs, network captures, and timestamps - not a vague score.
Built to forward to a lawyer, DPO, or enterprise client.
Catch regressions when marketing adds new tags after launch.
Concrete configuration and code-level fix guidance.
EU-hosted Estonian company operating under GDPR.
Workspaces, white-label proof, and evidence trails when you need them.
Regulators do not only pursue large companies. These are real decisions against small businesses, for exactly the defect a site ships with by default when nobody checks what runs before the banner.
Coral Travel & Tourism Services
A regional travel agency stored non-essential cookies and tracking modules before visitors had consented.
Lenjeria Magica
An online lingerie shop set cookies that were not technically necessary, with no clear information and no explicit consent.
Vueling Airlines
The cookie banner offered no way to refuse. Users were told to change their browser settings, and consent was inferred from continued browsing.
Iberia
Visitors searching for a flight were given no option to reject cookies and were told they had to accept to continue. Upheld on appeal.
Techpump Solutions
Third-party cookies stayed active after the visitor clicked reject all. Offering a reject button is not enough if the site keeps collecting.
France's regulator issued 83 sanctions in 2025, of which 21 were specifically about cookies and trackers. Its simplified procedure, capped at €20,000 and aimed at organisations of every size, was used 67 times that year. CNIL
And at the other end of the scale
Every figure on this page links to the issuing authority or a named legal source. We do not publish average fines, because no regulator produces one and any number claiming to be an average of these is invented.
Compliance tooling asks you to trust its judgement. It is reasonable to want to know whose judgement it is, and how the number is built.
Built in Estonia 🇪🇺 · Runtime privacy compliance specialist
LinkedIn profileott@securespells.comI launched SecureSpells because static HTML scrapers keep missing the scripts that actually trigger regulatory fines.
We treat privacy compliance like a network-level unit test, monitoring real browser execution so you get actual legal evidence, not a vague score.
Risk scoring uses published weights for severity, likelihood, regulatory focus, and user impact — not a black box. We build the runtime scanner, the check engine, the risk scoring model and the GDPR article mapping in house. Not a reseller of somebody else's scanner, and not a team you will never speak to.
We audit ourselves too
securespells.com scores 2.85 of 5, Medium, across 35 checks. It passes the pre-consent cookie check. It is not a perfect score, and we publish it rather than claim one.
Web trackers evolve. Regulatory enforcement shifts. Our audit engine updates continuously to keep your evidence aligned with current GDPR standards.
White-label retainers for agencies; annex-ready runtime packs for lawyers and DPOs. Capacity runs on reusable audit slots from the live plan catalog.
Reusable Audit Slots - Monitor active client projects. When a project is complete, reuse the slot for your next client after the rotation period.
First-audit guarantee
If your first paid audit finds nothing beyond what the free scan on this page already showed you, we refund it.
Run the free scan first, then compare it against the paid report. If the paid one surfaces no finding the free one missed, tell us within 14 days and the payment comes back. Applies to the one-off report and to the first month of a new subscription. No forms and no argument.
Including the ones where the honest answer is not the flattering one.
Free. No registration. No credit card required.
By running this scan, you confirm you are authorized to audit this domain and agree to our Terms of Service and Privacy Policy.
Prefer to look first?