The discovery half of a privacy health check, automated
Not long ago, finding out whether your website complied with the GDPR meant hiring people. A lawyer and a technically-minded colleague would spend the better part of a week going through the site by hand. Listing every third party each of the most popular pages loads, every cookie set before anyone clicked accept, every request quietly heading off to a server in the United States. Then they'd prioritise it, write it up, and hand you a report. It was genuinely useful work, and it was also a photograph: accurate the day it was taken.
A good part of that week was not legal reasoning. It was discovery: the repetitive inventory work that a machine can keep doing on the four-hundredth page as carefully as on the first. That is why specialists in this field run automated checks themselves before they start reasoning — the tool is in their toolbox, not a replacement for what they do with it.
What a GDPR discovery pass really involves
Strip a privacy health check down and the bulk of it is finding and counting things:
- Which third-party domains your pages contact, from analytics and fonts to embedded video, chat and marketing tags.
- Which cookies are set before consent, and what each one is for.
- Which known trackers are present, and which pages use local storage.
- Where visitor data is leaving the EU, usually to a US endpoint.
- The state of your TLS version and security headers.
None of that needs a legal opinion to gather. It needs patience and coverage, on every page rather than just the homepage. Which is precisely what Webperf Audit does, on every page, using our headless-Chromium Webbkoll fetcher. It gathers the same kind of inventory that otherwise has to be built by hand, and hands you the result as data you own outright.
The photograph problem
A one-off health check carries a built-in flaw since it starts ageing the moment it's delivered. The tracker that lands you in trouble usually isn't on the homepage the auditor checked. It's added to a campaign landing page six weeks later, by someone in a hurry, long after the consultant has invoiced and gone. The report can't see it, because the report was a moment and your website is a stream.
Continuous auditing catches that new third party the week it appears, while the person who added it still remembers why. The engagement bought you a single snapshot; the tool keeps the running record. That difference is the whole reason privacy checks belong on a schedule, not in a folder.
The analytics question, specifically
The other thing organisations reach for consultants about is web analytics. Google Analytics has spent years in legal weather. Regulators in Austria, France and Italy each ruled its use unlawful in 2022 over how it sent visitor data to the United States, and Sweden's IMY later fined companies on the same grounds. The footing under those transfers keeps shifting as one framework is struck down and the next is built: Safe Harbour, then Privacy Shield, now the Data Privacy Framework. The question doesn't disappear outside the EU, it changes shape. The UK runs its own adequacy assessment, and under Australia's APP 8 and Canada's accountability principle the sender stays responsible for the data after it leaves. It's genuinely confusing, and it's the sort of thing people book a webinar to make sense of.
But the first practical step is always the same, and it isn't legal. Know what you load. Before you can decide whether a US transfer is lawful, you have to establish that it's happening at all. The audit answers which of our pages set cookies before consent, and which ones phone home to Google, or to any other endpoint outside the EU?
with a per-page list rather than a guess. You can't have that debate without the inventory, and the inventory is what a tool can produce in minutes. The diagnosis — what it means for your organisation, and what you do about it — stays with the people who know why each of those scripts was added in the first place.
Where the tool stops, on purpose
Two parts of the old engagement stay firmly human, and no tool should claim otherwise.
- The first is judgment. Whether a specific transfer is lawful under today's framework, whether your consent wording is adequate, whether your data-processing agreements genuinely cover you, these are calls for someone who reads law for a living. A scan can prove a tracker fires before consent, but it can't tell you your legal exposure. The conclusions stay yours to draw, or your lawyer's.
- The second is the fix. Migrating off Google Analytics to an EU-hosted, privacy-respecting alternative such as Matomo, gating trackers behind real consent, self-hosting your fonts, none of that happens by observing it. The audit points at the work, but people still do it.
What that leaves you with
So the privacy health check doesn't vanish. It changes shape. The repeatable part of it, the discovery and the inventory, is work that can now run every day rather than once. The scarce human hours start with that inventory already in front of them, and go where they were always worth most: weighing the risk and repairing it. And when you do bring in a lawyer, you can point them at a live, exportable audit instead of a PDF that went stale the month it was written.
This is the same division of labour we keep returning to. The tool does the tireless counting, but people do the thinking. Privacy is simply a case where the counting used to cost a great deal, and the thinking got buried underneath it.
The traditional health check was a good idea trapped in an expensive, one-time format. Part of what made it valuable, a current record of what your site loads and sets, is exactly the kind of work software should carry. Keep your people for the parts that need a person. Let the tool do the crawling.
The cookie and third-party audit is included in every plan, and Webperf Audit runs the automated privacy checks across every page. See the plans, or email hello@webperf.cloud.