New privacy laws arrive every year, in US states and around the world. GRAIVA keeps track of the rules that apply to your website and checks it against them. Type your site: in about a minute we show every gap, with the evidence behind each one.
| Item | Count | Note |
|---|---|---|
| browser passes | 4 | No click, Reject all, Accept all, and the GPC signal. |
| pages read | 25 | Policy, terms, cookie and contact pages first. |
| cited rules | 79 | Each one links to its primary legal source. |
| banner tools recognised | 35 | We know where their Reject button hides. |
| per scan | ~60 s | Measured p95 on our nightly test set. |
Before a visitor clicks anything, the page has already loaded its tags. That first second is where privacy law is clearest, and where most small-business sites fall down.
Gap 1 of 4Tap a number, or wait for the next
Analytics and ad pixels that load the moment the page opens. Under GDPR, UK GDPR and DPDP, consent has to come first.
Reject hidden one layer deep, or missing. We click both and measure how many steps each one takes.
Global Privacy Control is a legal opt-out in California. We send it and watch what still fires.
Who you share data with, how long you keep it, how to complain. We read your policy against each cited rule.
We use cookies to improve your experience.
The GDPR allows fines of up to €20 million or 4% of worldwide annual turnover (Art. 83(5)). Maximum under the law, not a prediction of any fine.
Many banners hide the button and change nothing behind it. We click Reject the way a visitor would, then log every request that still leaves the page.
We also send Global Privacy Control and log what ignores it.
First visit, no click
9tracker requests before any choice
Each request we log is kept as evidence: the host, the time and the cookie it set.
Quoted from example-bakery.co.uk/privacy
“We keep your information for as long as necessary.”
The policy names no period and no criteria for deciding one. Art. 13(2)(a) asks for either.
Fix: State how long each kind of data is kept, or the criteria you use. The planned document pack will write this clause for you.
Example finding · synthetic data
| Check | Banner-only tools | GRAIVA |
|---|---|---|
| Shows what loads before a visitor chooses | Sometimes | Every scan |
| Clicks Reject and checks what still fires | Rarely | Every scan |
| Sends Global Privacy Control | Rarely | Every scan |
| Reads your privacy policy against cited rules | No | Rolling out |
| Shows the request, cookie or page behind each finding | No | Always |
| Shows an answer it cannot prove as unclear | No | Always |
Shows what loads before a visitor chooses
Clicks Reject and checks what still fires
Sends Global Privacy Control
Reads your privacy policy against cited rules
Shows the request, cookie or page behind each finding
Shows an answer it cannot prove as unclear
Compared with consent-banner tools as a category. When a check passes we say “no gaps found against N checks” and give the date, never more than the evidence shows.
We work out which laws likely apply from your domain, language, currency, phone numbers and address, and tell you why.
No. The scan shows evidence against cited rules. Anything we generate is a template. This is a template, not legal advice. Have it reviewed by your legal counsel before relying on it.
No scan can honestly promise that, so we never do. When a check passes we say “no gaps found against N checks as of” the scan date, and we show the evidence.
Only your website address. We read public pages, the way any visitor can. Nothing to install, no logins, no access to your systems.
The full report is long and specific to your business. We confirm the email with a 6-digit code so the report goes to you and nobody else. No newsletter unless you ask for one.
It says “not measured” or “unclear”, never “pass”. Some sites block automated visitors; we tell you when that happens.
Yes. Six risks that are counted per visitor, per email, per child or per work: fonts loaded from Google’s servers, session recording before consent, sign-ups without a children statement, marketing email sign-ups, subscription prices without renewal terms, and user uploads without a DMCA agent.
India’s DPDP Act, the GDPR, the UK GDPR and California’s CCPA/CPRA, plus cross-cutting checks. We detect which ones likely apply from your domain, language, currency and contact details.
One address. About a minute. Evidence for every finding.