This translation has not been editorially reviewed yet. The German version is authoritative. German version →
Data & legal
GDPR and Cookie Checking: Does Rejection Really Work?
Most cookie banners look compliant. The question is another: Does the rejection work technically? We click “Reject”, reload and measure what loads anyway – cookies, trackers, third-party embeds. Before and after consent.
- Rule set dsgvo-v1Scope and rule set are stated in the report, countable.
- Human reviewClear decisions in the gold standard: a person judges disputed cases.
- TraceableEvery finding with reasoning, source and location.
- Publicly verifiableVia audit ID, QR code and an open verification page.
What is checked in detail
- Cookies and storage accesses BEFORE any consent
- Third-party requests and embedments (fonts, cards, videos, analytics) before consent
- Effectiveness of rejection: serving banners, reloading them, re-measuring them
- Transparency information: Accessibility of data protection declaration and imprint
How your partial seal comes about
- Prove the domainDNS TXT record or file in the .well-known path.
- Choose the scopeBy page tier, up to 1,000 pages.
- Automated auditEverything technically decidable is measured.
- Auditor judgementA person judges disputed cases, in the gold standard.
- Partial sealFrom 90 of 100 points in this audit area.
The result: a verifiable partial seal
If your website reaches the target in this audit area, you receive a partial seal with its own audit ID and a public verification page with result, audit date and validity. How the audit proceeds is described in the audit procedure, the conditions under pricing.
Topics in detail
11 pages along the guidelines of the rule set, each with the associated checkpoints and its own questions.
- Tracking-Cookies vor der Einwilligung: der schwerwiegendste Befund
- Tracker-Verbindungen vor der Einwilligung: die IP reicht schon
- Videos, Karten und Feeds: Einbettungen erst nach Zustimmung laden
- Web-Schriften lokal einbinden: der am leichtesten behebbare Befund
- Braucht diese Seite überhaupt ein Banner?
- Wie kommt man wieder heraus?
- Ablehnen auf der ersten Ebene: gleich sichtbar, nicht versteckt
- Wirkt „Ablehnen" technisch? Der Prüfer klickt und misst nach
- Datenschutzerklärung: erreichbar von jeder Seite
- HTTPS: Voraussetzung, nicht Auszeichnung
- Das vollständige Inventar: wer alles mitlädt
What a result looks like
Every criterion receives exactly one of three judgements. A criterion is never considered met just because the measurement found nothing.
- Met: demonstrably, with evidence
- Still open: awaits an auditor judgement
- Still to be met: location, rule and remedy named
A partial seal is issued from 90 of 100 points in this audit area.
Our own website currently reaches 90 of 100.
Good to know
- We examine technology, not legal texts — this is not legal advice.
- What matters is what is loaded before consent.
- Whether a “rejection” works technically, is measured, not believed.
