For web agencies across the EU
Every site you deliver is a compliance liability. Or a recurring invoice.
GDPR enforcement is no longer aimed only at large platforms. The violations that produced nine-figure fines in 2025 are technically identical to what runs on the small business sites your agency builds. You can be the one who finds them first.
GDPR enforcement across the EU
The regulator is no longer only chasing platforms.
Thirty supervisory authorities now enforce the same regulation across the EEA, and the pace has changed sharply: most of the money ever fined under the GDPR has been imposed in the last three years.
In 2025 the French authority alone fined Google €325M and SHEIN €150M for cookies placed without valid consent.3 The Dutch authority fined Kruidvat €600,000 for pre-ticked boxes and issued formal warnings to more than 200 websites.4 Those two facts describe the same enforcement logic applied at two very different scales.
What the audit actually checks.
Most consent tools verify that a banner exists. Argus loads the site in a real browser, refuses consent as a user would, and records what still leaves for the network.
Consent Bypass Test
Argus clicks “Reject all”, then records every request that still leaves. This is the violation that cost Google €325M and SHEIN €150M in 2025, technically identical to what happens on ordinary client sites.
Server-side tracking
GTM Server-Side containers, Meta CAPI relays and CNAME-resolved subdomains that route data to third parties while appearing first-party to blockers.
Dark patterns in banners
Asymmetric buttons, extra clicks required to refuse, pre-ticked boxes. The Dutch DPA fined Kruidvat €600,000 for pre-ticked consent and warned over 200 websites.
Transfers outside the EEA
Session replay, analytics and advertising endpoints hosted outside the EEA, checked against the safeguards required by Chapter V of the GDPR.
Storage-based tracking
localStorage, sessionStorage and IndexedDB identifiers, which survive third-party cookie deprecation and are invisible to most consent tools.
Security headers
HSTS, CSP, X-Frame-Options and related headers, scored against OWASP recommendations and included in the same report.
Partner packs.
Billed annually, no hidden subscription. A single audit resold at your own rate covers a large share of the yearly cost.
Web agency
Agency Pack
Or €166 / month · 12-month term
€39.80 per audit
- 50 audits per year
- Co-branded reports
- Dedicated partner portal
- For teams of 3 to 20
Agency · most chosen
Agency Pro Pack
Or €416 / month · 12-month term
€33.27 per audit
- 150 audits per year
- Full white label, no ScanRGPD mention
- Art. 28 GDPR timestamping
- For agencies running at scale
Sources
- DLA Piper GDPR fines and data breach survey, January 2026 (cumulative total, 2025 volume, post-2023 acceleration). Link
- CMS GDPR Enforcement Tracker, case count as of 1 March 2026. Link
- CNIL decisions of 2025 against Google (€325M) and SHEIN (€150M) for cookies placed without valid consent. Link
- Dutch DPA (Autoriteit Persoonsgegevens) fine against Kruidvat for pre-ticked consent boxes. Link
Figures are reproduced as published by the cited sources. Totals differ between trackers because methodologies differ: some record only publicly disclosed decisions.