In September 2025, France's data protection authority, the CNIL, fined SHEIN €150 million after inspectors found advertising cookies placed on visitors' devices the moment they arrived, before they had touched the cookie banner. Clicking "Reject all" didn't stop it: new cookies were still placed and existing ones kept being read (CNIL).
Both failures are visible to anyone with a web browser. To check your own site, you need a private window, your browser's developer tools and about 15 minutes.
This 10-step self-audit is for small businesses without in-house legal help: Steps 1–4 are browser checks, and Steps 5–10 cover the paperwork no tool can see.
⚠️ Important: No scanner, plugin or consultant can certify that a website is "GDPR compliant." Compliance depends on why you collect data, what your vendors do with it and how you handle requests, and none of that appears in page code. A scan finds technical red flags; a clean result is not a legal guarantee.
What GDPR Expects From a Typical Small-Business Website
The General Data Protection Regulation (GDPR) governs personal data, including online identifiers such as IP addresses and cookie IDs. It reaches businesses outside Europe too: under Article 3(2), it applies if you offer goods or services to people in the EU or monitor their behavior there, for example with analytics or ad pixels.
The cookie rule itself comes from the ePrivacy Directive. Its Article 5(3) requires consent before a site stores or reads information on a visitor's device, unless that is strictly necessary for a service the visitor asked for.
| Requirement | Source | What it means on your website |
|---|---|---|
| Lawful basis | GDPR Art. 6 | One of six legal grounds for each use of data, e.g. consent for a newsletter, contract for an order |
| Cookie consent | ePrivacy Art. 5(3); GDPR Art. 7 | Analytics, ad pixels and session replay wait for opt-in; strictly necessary cookies are exempt |
| Transparency | GDPR Arts. 12–14 | A plain-language privacy notice: who you are, why you collect data, who gets it, how long you keep it |
| Individual rights | GDPR Arts. 15–22 | Access, correction, deletion, portability and objection, answered within one month |
| Security | GDPR Art. 32 | HTTPS, patched software, access controls on admin panels and inboxes |
| Processors | GDPR Art. 28 | A data processing agreement (DPA) with every vendor that handles data for you |
| Transfers | GDPR Arts. 44–49 | A legal mechanism for data leaving the EU, such as the EU-US Data Privacy Framework or Standard Contractual Clauses |
The most serious violations carry fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5)). Non-EU businesses covered by Article 3(2) must generally also designate an EU representative in writing (Article 27), unless their processing is occasional, low-risk and excludes large-scale sensitive data.
Steps 1–2: Run a Free Scan, Then Watch What Fires Before Consent
Step 1: Run an automated scan for a baseline. The free ScanComply privacy scan reads your page code and reports:
• Whether a privacy policy link and a cookie consent banner are detected
• Known trackers such as Google Analytics, Meta Pixel, TikTok Pixel, Hotjar and Microsoft Clarity, flagged when no banner is detected
• A "Do Not Sell or Share" link, which California's CCPA expects from businesses that sell or share personal data
• Forms collecting personal data over plain HTTP, and missing Secure or SameSite flags on tracking cookies
• An informational Global Privacy Control (GPC) signal check that reports what it finds but does not prove compliance
• Known trackers such as Google Analytics, Meta Pixel, TikTok Pixel, Hotjar and Microsoft Clarity, flagged when no banner is detected
• A "Do Not Sell or Share" link, which California's CCPA expects from businesses that sell or share personal data
• Forms collecting personal data over plain HTTP, and missing Secure or SameSite flags on tracking cookies
• An informational Global Privacy Control (GPC) signal check that reports what it finds but does not prove compliance
Save the report as your "before" picture.
Step 2: Watch what loads before consent. The most revealing test is simple: load your site in a private window with the browser's Network tab open and see what fires before you click anything. In Chrome:
1. Open an Incognito window so no earlier consent choice is stored.
2. Open developer tools (F12 on Windows, Cmd+Option+I on a Mac) and select the Network tab.
3. Tick Preserve log and Disable cache, load your homepage and leave the banner alone.
4. Choose More filters › 3rd-party requests (Chrome docs) to hide your own files.
5. Look for domains such as google-analytics.com, doubleclick.net, facebook.com, clarity.ms and hotjar.com.
2. Open developer tools (F12 on Windows, Cmd+Option+I on a Mac) and select the Network tab.
3. Tick Preserve log and Disable cache, load your homepage and leave the banner alone.
4. Choose More filters › 3rd-party requests (Chrome docs) to hide your own files.
5. Look for domains such as google-analytics.com, doubleclick.net, facebook.com, clarity.ms and hotjar.com.
Any analytics or advertising request that fires before you choose is a red flag. A googletagmanager.com file loading on its own isn't automatically a problem; what matters is whether it then fires tags, such as google-analytics.com/g/collect (Google Analytics 4) or facebook.com/tr (Meta Pixel).
Steps 3–4: Test the Banner, Then the Cookies It Leaves Behind
Step 3: Test the banner like a skeptical visitor. Check each point:
• Reject is as easy as Accept. In the EDPB's 2023 cookie banner taskforce report, a vast majority of EU regulators said a banner with a consent button but no reject option on the same layer is an infringement.
• No pre-ticked boxes. The EU Court of Justice ruled in Planet49 (October 1, 2019) that a pre-checked box is not valid consent.
• No consent by scrolling. EDPB guidelines say scrolling or swiping "will not under any circumstances" count as consent.
• No cookie wall. Blocking content until someone accepts leaves no genuine choice.
• No misleading design. The taskforce flagged deceptive button colors and contrast.
• Easy withdrawal. Under Article 7(3), withdrawing consent must be as easy as giving it. Keep a "Cookie settings" link on every page.
• No pre-ticked boxes. The EU Court of Justice ruled in Planet49 (October 1, 2019) that a pre-checked box is not valid consent.
• No consent by scrolling. EDPB guidelines say scrolling or swiping "will not under any circumstances" count as consent.
• No cookie wall. Blocking content until someone accepts leaves no genuine choice.
• No misleading design. The taskforce flagged deceptive button colors and contrast.
• Easy withdrawal. Under Article 7(3), withdrawing consent must be as easy as giving it. Keep a "Cookie settings" link on every page.
Then click Reject, reload and repeat Step 2. No analytics or ad requests should appear. That is where SHEIN failed; in October 2026 the CNIL also fined Fnac Darty €7 million for app tracking that continued after users said no (see our autumn 2026 EU roundup).
Step 4: Inspect the cookies. In Chrome, open Application › Storage › Cookies (in Firefox, the Storage tab) in a fresh private window before touching the banner:
• Fine before consent: strictly necessary cookies such as session, cart, security and load balancing, plus the cookie that stores the banner choice.
• Red flags: _ga or _ga_ cookies (Google Analytics), _fbp (Meta Pixel), _clck and _clsk (Microsoft Clarity), _hjSessionUser_ (Hotjar), _ttp (TikTok).
• After Reject: clear cookies, reload and confirm the red flags stay gone.
• Red flags: _ga or _ga_ cookies (Google Analytics), _fbp (Meta Pixel), _clck and _clsk (Microsoft Clarity), _hjSessionUser_ (Hotjar), _ttp (TikTok).
• After Reject: clear cookies, reload and confirm the red flags stay gone.
Also check the Secure and SameSite columns on tracking cookies; the scan reports missing flags.
Start Step 1 Now: Free Privacy Scan
ScanComply's free privacy scan checks for a privacy policy link, a consent banner, known trackers, a Do Not Sell or Share link, form and cookie security, and Global Privacy Control handling.
Run Free Privacy Scan →Steps 5–7: Privacy Notice, Forms and Rights Requests
Step 5: Check your privacy notice against Article 13. When you collect data directly from people, Article 13 lists what to tell them:
• Who you are, how to reach you, and your EU representative or data protection officer if you have one
• Each purpose, its lawful basis and any "legitimate interests" you rely on
• Who receives the data (hosting, email, analytics, payments, advertising) and any transfers outside the EU
• How long you keep each type of data
• People's rights, including withdrawing consent and complaining to a data protection authority
• Any automated decision-making, including profiling
• Each purpose, its lawful basis and any "legitimate interests" you rely on
• Who receives the data (hosting, email, analytics, payments, advertising) and any transfers outside the EU
• How long you keep each type of data
• People's rights, including withdrawing consent and complaining to a data protection authority
• Any automated decision-making, including profiling
Article 12 requires "clear and plain language." A notice that hasn't changed since you added a chat widget or ad pixel is probably out of date. Under Planet49, your cookie information should also say how long cookies last and whether third parties can access them.
Step 6: Audit your forms. Every contact, quote and checkout form should submit over HTTPS. Then apply data minimization: Article 5(1)(c) says personal data must be "limited to what is necessary," so delete fields you never use.
Step 7: Test your rights-request path. Pretend to be a customer asking for a copy of their data: does your notice give a working email or form that reaches a person? You have one month to respond, extendable by two further months for complex or numerous requests if you tell the person within the first month. Write a one-page procedure covering identity checks, where to search and who replies.
Also have California customers? If you sell or share personal data for targeted advertising, the CCPA generally requires a "Do Not Sell or Share My Personal Information" link and honoring Global Privacy Control signals; see our California GPC guide and what changes on January 1, 2027.
Steps 8–10: Vendors, Analytics Settings and Your Paper Trail
Step 8: List every vendor and collect the contracts. Combine the third-party domains from Step 2 with your software invoices in one spreadsheet: vendor, purpose, data received, location and whether you have a DPA. Article 28 requires a written contract with every processor; most large vendors publish a standard DPA you can save.
For US vendors, record the transfer mechanism. The EU-US Data Privacy Framework (July 2023) survived a General Court challenge on September 3, 2025, but the ruling was appealed to the Court of Justice on October 31, 2025 (WilmerHale). Confirm each US vendor is certified and keep Standard Contractual Clauses as a fallback.
Step 9: Review your analytics settings.
• Consent Mode. In Google's basic mode, tags are blocked until the visitor interacts with the banner. In advanced mode, tags load immediately and send "cookieless pings" while consent is denied (Google), so Google is contacted before consent; check that this fits your risk tolerance.
• IP addresses. Google says Google Analytics 4 does not log or store IP addresses (Google Analytics Help), but the browser still connects to Google when a tag fires, so this doesn't replace consent.
• Retention. Pick the shortest data retention period you need and switch off unused data-sharing settings.
• IP addresses. Google says Google Analytics 4 does not log or store IP addresses (Google Analytics Help), but the browser still connects to Google when a tag fires, so this doesn't replace consent.
• Retention. Pick the shortest data retention period you need and switch off unused data-sharing settings.
Step 10: Write it down. Under Article 5(2), you must be able to demonstrate compliance. Keep a dated folder of scan reports, screenshots, the vendor spreadsheet, DPAs and privacy notice versions. Re-run Steps 1–4 whenever you add a plugin, pixel or widget, and at least quarterly.
What an Automated Scan Can Check vs. What Needs a Human
How the work splits:
| Area | An automated scan can check | Needs a human |
|---|---|---|
| Privacy policy | Whether a policy link exists | Whether it covers Article 13 and matches what you actually do |
| Cookie banner | Whether a banner or consent platform is detected | Whether Reject is equally easy and withdrawal works |
| Trackers | Known tracker scripts, flagged when no banner is detected | Whether tags wait for consent and stop after Reject |
| Cookies | Secure and SameSite flags on tracking cookies | Which cookies are truly strictly necessary |
| Forms | Personal-data forms submitting over plain HTTP | Whether every field is needed |
| Opt-out signals | Do Not Sell or Share link; GPC handling (informational) | Whether opt-outs actually reach your vendors |
| Vendors, rights, lawful basis | Not visible in page code | DPAs, transfers, request procedure, retention periods |
Automation finds what's on the page; people judge what it means. If you're choosing tools, our comparison of GDPR and CCPA compliance tools covers seven options for small businesses.
Found More Gaps Than You Can Fix?
The $97 Privacy Fix Kit turns your scan findings into a plain-English audit, platform-specific fix guide, developer handoff email and remediation tracker, reviewed by our team and delivered within 2 business days.
See the Privacy Fix Kit →Checking whether your website is GDPR compliant comes down to two questions. Does anything track visitors before they say yes, and can you show you handle their data the way your notice says? Steps 1–4 answer the first in about 15 minutes. Steps 5–10 answer the second, and they're what a regulator asks for after a complaint.
Related: how GDPR fines passed €5.88 billion and the autumn 2026 EU crackdown and cookie reform.
This article is general information, not legal advice.
Sources:
• CNIL: SHEIN fined €150 million for cookies placed without consent
• Court of Justice press release on Planet49, Case C-673/17
• EDPB Cookie Banner Taskforce report, January 2023
• EDPB Guidelines 05/2020 on consent
• WilmerHale on the Data Privacy Framework appeal