Module · XICTRAQ

GDPR scanner for websites — protect SMBs from legal warnings

Automatically check pre-consent trackers, Google Fonts, cookie consent and mandatory pages — before competitors or law firms send a warning letter.

Included in free tier

Get started free Live demo

No credit card Servers in Germany 3 EU probe nodes 14-day pro trial GDPR compliant

Live status

GDPR scanner for websites — protect SMBs from legal warnings

ACTIVE

Pre-Consent Tracker Detection

Simulation of a first-time visitor without cookie consent. XICTRAQ records the trackers, cookies and network requests that occur on the first visit before consent.

Cookie Consent Validation

Check if your consent banner works correctly: Are all tracking cookies actually blocked when rejected? Is the reject button equally visible?

Imprint and Privacy Policy Check

Automatic check whether imprint and privacy policy exist and are accessible from every subpage. Detection of missing mandatory information.

Third-Party Service Analysis

Detection of embedded third-party services (Google Fonts, YouTube, Maps, Analytics). Check for GDPR-compliant integration and data transfer to third countries.

Last check just now

What it does

GDPR violations can result in fines of up to 20 million euros or 4% of annual revenue. Even more common are cease-and-desist notices from competitors or specialized law firms. XICTRAQ scans your website for pre-consent trackers, validates your cookie consent solution and verifies mandatory pages like imprint and privacy policy. This minimizes your legal risk.

Pre-Consent Tracker Detection

Simulation of a first-time visitor without cookie consent. XICTRAQ records the trackers, cookies and network requests that occur on the first visit before consent.

01 / 07

Cookie Consent Validation

Check if your consent banner works correctly: Are all tracking cookies actually blocked when rejected? Is the reject button equally visible?

02 / 07

Imprint and Privacy Policy Check

Automatic check whether imprint and privacy policy exist and are accessible from every subpage. Detection of missing mandatory information.

03 / 07

Third-Party Service Analysis

Detection of embedded third-party services (Google Fonts, YouTube, Maps, Analytics). Check for GDPR-compliant integration and data transfer to third countries.

04 / 07

Legal Risk Assessment

Overall legal risk rating (low, medium, high) based on all detected violations. Prioritized action recommendations for risk minimization.

05 / 07

Compliance Report

Detailed PDF report of all GDPR-relevant findings. Usable as evidence for data protection officers or in response to regulatory authority inquiries.

06 / 07

Neutralised API retrieval

If you feed monitoring data into your own systems, you can retrieve it without names, e-mail addresses, postal addresses and phone numbers: an API key with the „neutral“ scope always returns neutralised responses, and per request the X-Neutral: 1 header does the same. The response header X-Neutralisiert: 1 proves the data was stripped — downstream processing should check that header rather than trust its own request.

07 / 07

Process

How it works

Enter website URL

Enter your website URL. XICTRAQ visits your site like a normal first-time visitor -- without prior cookies or consent -- and records what is loaded and set along the way.

Automatic GDPR analysis

The scan checks pre-consent trackers, cookie behavior, third-party services, mandatory pages and consent banner functionality. Results in under 2 minutes.

Fix risks and re-verify

Receive a prioritized action plan. After implementation, you can start a re-scan at any time to verify the fix.

FAQ

Frequently Asked Questions

What are pre-consent trackers?

Pre-consent trackers are cookies or tracking scripts set before the visitor has given consent via the cookie banner. This is prohibited under GDPR and the ePrivacy Directive and is one of the most common reasons for legal warnings.

Does XICTRAQ replace a data protection officer?

No. XICTRAQ is a technical monitoring tool and does not replace legal advice. It detects technical GDPR violations on your website and helps you fix them. For legal questions, you should consult a data protection officer.

Are Google Fonts detected as a GDPR issue?

Yes. XICTRAQ detects externally loaded Google Fonts and points out that embedding via Google servers transfers personal data (IP address) to Google in the USA. Local hosting of fonts is recommended.

How does XICTRAQ detect if the cookie banner works correctly?

XICTRAQ first visits the page without any consent and records the trackers and cookies already loaded. It then clicks the reject button and checks whether the trackers and cookies are actually blocked afterwards.

How often should a GDPR scan be performed?

We recommend at least weekly scans, as new third-party scripts or CMS updates can unknowingly introduce GDPR issues. For frequent website changes, daily scans are advisable.

Are US data transfers also checked?

Yes. XICTRAQ detects typical US third-party services such as Google Fonts, Google Analytics, Google Maps, reCAPTCHA and Facebook Pixel and flags their integration as a legal risk, since they can transfer personal data to the USA.

Can the data be transferred into our own systems in a GDPR-compliant way?

Yes. The API offers a neutralised retrieval mode that removes names, e-mail addresses, postal addresses and phone numbers from the response while leaving every other field untouched. Enable it permanently via the „neutral“ key scope, or per request via X-Neutral: 1 or neutral=1. The wildcard scope * deliberately does not include „neutral“ — neutralisation is always set explicitly. Only the response header X-Neutralisiert: 1 tells you a response was actually neutralised.