Website GDPR Audit

What it runs

1. 1
   GDPR Website Check

   Source: HTTP fetch + automated compliance pattern scanning

2. 2
   Cookie Scan

   Source: Web page rendering (cookie detection, script analysis, consent banner check)

3. 3
   Privacy Policy Analysis

   Source: HTTP fetch + Claude API (privacy policy analysis)

4. 4
   SSL Certificate Check

   Source: TLS handshake (X.509 certificate from target server)

5. 5
   Data Protection Authority Lookup

   Source: Static database (EU/EEA Data Protection Authority registry)

The answer returns every step’s result, so your agent can show or check each one.

Inputs

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/gdpr-audit/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "url": "https://google.com",
      "country_code": "SE"
    },
    "max_price_cents": 100
  }'

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/solutions/gdpr-audit \
  -H 'Content-Type: application/json' \
  -d '{
    "url": "https://google.com",
    "country_code": "SE"
  }'

The bundle’s published example input.

Limitations

• Automated scan checks for common compliance indicators — does not constitute a legal compliance audit

  From step: GDPR Website Check

  What to do instead: Use the flagged items as a checklist for your DPO or legal team to prioritize their manual review

• Checks visible elements only — cannot assess internal data processing practices

  From step: GDPR Website Check

  What to do instead: Combine with a manual review of the company's data processing agreements and internal privacy impact assessments

• Scans cookies set on initial page load — cookies set after user interaction or on sub-pages may not be captured

  From step: Cookie Scan

  What to do instead: Run separate scans on high-traffic sub-pages (e.g., /checkout, /login) and merge the cookie inventories

• AI-powered analysis identifies common GDPR requirements — does not replace legal review

  From step: Privacy Policy Analysis

  What to do instead: Use the gap analysis output to brief your legal counsel on specific sections requiring human review

• Analyses the linked privacy policy page only — separate cookie policies or terms may not be included

  From step: Privacy Policy Analysis

  What to do instead: Pass each policy URL (privacy, cookies, terms) as separate requests and combine the results

• Structured output is limited to about 2000 output tokens per call; requests exceeding this limit are refused rather than returned truncated. Requests with large results can exceed this limit, and repeating the same request does not help.

  From step: Privacy Policy Analysis

  What to do instead: Read the original policy directly for details that exceed the output limit.

• Checks the certificate presented on port 443 only — does not verify non-standard TLS configurations

  From step: SSL Certificate Check

  What to do instead: For services on non-standard ports, use ssl-certificate-chain with the specific hostname:port combination

• Covers all EU/EEA member state DPAs — does not include sub-national authorities (e.g., German Länder DPAs)

  From step: Data Protection Authority Lookup

  What to do instead: For German entities, map the company's registered state to the corresponding Landesdatenschutzbeauftragter via datenschutz.de