GDPR audit

Satsu renders your pages the way a first-time visitor sees them — without touching any consent banner — and records what actually happens: which scripts load, which cookies get set, where requests go. That's the standard regulators and warning-letter firms apply, and it routinely contradicts what site owners believe their consent setup does.

Everything below is guidance, not legal advice.

What the categories mean

• Trackers — third-party scripts (ad pixels, analytics, social embeds) that process visitor data. Under the GDPR they need informed consent before they load. A tracker firing pre-consent is the classic violation.
• Cookies — § 25 TDDDG (the German implementation of the ePrivacy rules, formerly § 25 TTDSG) requires consent for any non-essential access to the visitor's device. The audit lists every non-essential cookie set before consent.
• Fonts — webfonts loaded from third-party servers send every visitor's IP address there. The Munich Regional Court (LG München I, 3 O 17493/20) ruled in 2022 that a Google Fonts load from US servers is an actionable violation — and awarded damages. Self-hosting closes the issue mechanically.
• Data transfer — since the CJEU's Schrems II judgment (C-311/18), transfers to US servers need a valid legal basis; the successor framework remains under legal challenge. The audit flags requests to servers in the USA so you know your exposure.
• Transparency — a reachable privacy policy is a GDPR requirement; German-market sites additionally need an imprint (Impressum, § 5 DDG, formerly TMG). Both are trivially machine-detectable, which makes missing ones a favorite target for automated warning letters.

How to read the risk rating

Critical findings are pre-consent cookies, external Google Fonts and a missing imprint; third-party trackers are reported as warnings. Fix the critical ones first — each finding carries a concrete fix, and most are config-level: self-host the font, gate the script behind consent, add the missing legal page.

Where Satsu itself stands

Satsu's own tracking is cookieless by design — sessions derive from a fingerprint that changes at 00:00 UTC and cannot be linked across days, and Satsu sets nothing on the device and stores no identifier there (the only read is the optional satsu_ignore opt-out flag). In our assessment Satsu needs no consent banner entry; check with your own counsel for your site. The full story is in How it's private.