GDPR Website Check

Scan a website for signs of GDPR compliance (cookie consent, privacy policy, tracking scripts and security headers) and grade it from A to F.

Pay by wallet (x402) gdpr-website-check

Example

Example answer

{
  "url": "https://www.google.com/",
  "grade": "D",
  "findings": [
    "No cookie consent mechanism detected",
    "No privacy policy link found",
    "Missing HSTS header",
    "Cookies set without Secure flag",
    "Cookies set without SameSite attribute"
  ],
  "gdpr_score": 30,
  "uses_https": true,
  "cookie_issues": [
    "Cookies set without Secure flag",
    "Cookies set without SameSite attribute"
  ],
  "tracker_count": 0,
  "security_headers": {
    "csp": false,
    "hsts": false
  },
  "tracking_scripts": {
    "hotjar": false,
    "segment": false,
    "mixpanel": false,
    "tiktok_pixel": false,
    "facebook_pixel": false,
    "google_analytics": false,
    "linkedin_insight": false
  },
  "has_cookie_policy": false,
  "has_cookie_consent": false,
  "has_privacy_policy": false,
  "has_terms_of_service": false
}

Inputs

Field	Type	Required	What it is
`url`	string	Yes	—

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`grade`	string	Always (present in every successful answer)
`gdpr_score`	integer	Always (present in every successful answer)
`tracking_scripts`	object	Always (present in every successful answer)
`has_cookie_consent`	boolean	Always (present in every successful answer)
`has_privacy_policy`	boolean	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "gdpr-website-check",
    "inputs": {
      "url": "https://google.com"
    },
    "max_price_cents": 10
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "gdpr-website-check",
    "inputs": {
      "url": "https://google.com"
    },
    "max_price_cents": 10
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "gdpr-website-check",
  inputs: {
    "url": "https://google.com"
  },
  max_price_cents: 10,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="gdpr-website-check",
    inputs={
        "url": "https://google.com",
    },
    max_price_cents=10,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/gdpr-website-check?url=https%3A%2F%2Fgoogle.com'

Limitations

Automated scan checks for common GDPR indicators but does not constitute a legal compliance audit
Automated scan checks for common compliance indicators — does not constitute a legal compliance audit
What to do instead: Use the flagged items as a checklist for your DPO or legal team to prioritize their manual review
Checks only visible website elements — cannot assess internal data processing practices
Checks visible elements only — cannot assess internal data processing practices
What to do instead: Combine with a manual review of the company's data processing agreements and internal privacy impact assessments

Bundled checks that include it

Website GDPR Audit €1.00

Related tools

Domain Reputation €0.05