The checks we run
The checks we run. This is the complete set of checks Sitetals performs. Nothing outside this list is assessed, and nothing outside it is asserted in any scan or report. 18 checks are active as at , verified against our production rule set on that date. For each check we state what we observe. We do not state here how we observe it — that per-check method note is printed in the paid report, and will be added to this page once every entry has been verified against our code. Some checks cannot be evaluated on some sites; where that happens, the report records that the check was not evaluated, and does not record a pass.
| Check name | Jurisdiction | Severity | Legal reference | What we observe | Where it appears |
|---|---|---|---|---|---|
| Legal Notice (Mentions Légales) | France | Critical | LCEN Art. 1-1 (Loi n° 2004-575 du 21 juin 2004 pour la confiance dans l'économie numérique, dans sa rédaction issue de la loi n° 2024-449 du 21 mai 2024) | We look for a legal-notice page reachable from the pages we read; we do not check what it contains. | Free scan: category and severity only · Paid report: full detail |
| Cookie Consent Mechanism | France | Critical | Art. 82 de la loi n° 78-17 du 6 janvier 1978 (transposition de l'art. 5, § 3 de la directive 2002/58/CE) ; lignes directrices CNIL, délibération n° 2020-091 du 17 septembre 2020, et recommandation, délibération n° 2020-092 du 17 septembre 2020 ; conditions du consentement : RGPD art. 4, 11) et art. 7 ; plafond de sanction : art. 20, III de la loi n° 78-17 (10 M€ ou 2 % du chiffre d'affaires annuel mondial, le montant le plus élevé étant retenu) | Where the pages we read load a non-essential tracker, we look for a consent mechanism and for a way of refusing offered alongside acceptance. | Free scan: category and severity only · Paid report: full detail |
| Data Protection Policy | France | Critical | RGPD Art. 13 et 14 (Règlement UE 2016/679) | We look for a privacy or data-protection policy reachable from the pages we read; we do not check what it contains. | Free scan: category and severity only · Paid report: full detail |
| SSL / TLS Encryption | France | High | RGPD Art. 32 (sécurité du traitement) + recommandations ANSSI | We check whether the site answers over HTTPS at both spellings of its address, with and without www, and whether the certificate it presents is accepted when the connection is made. | Free scan: category and severity only · Paid report: full detail |
| Third-Party Analytics | France | High | Art. 82 de la loi n° 78-17 du 6 janvier 1978 (transposition de l'art. 5, § 3 de la directive 2002/58/CE) — consentement préalable à toute lecture ou inscription d'informations dans le terminal, sauf exceptions de l'art. 82, al. 2 ; lignes directrices CNIL, délibération n° 2020-091 du 17 septembre 2020 (conditions de l'exemption « mesure d'audience », que Google Analytics ne remplit pas), et recommandation, délibération n° 2020-092 du 17 septembre 2020 ; conditions du consentement : RGPD art. 4, 11) et art. 7 ; plafond de sanction : art. 20, III de la loi n° 78-17 (10 M€ ou 2 % du chiffre d'affaires annuel mondial, le montant le plus élevé étant retenu) | We look for a Google Analytics tag that loads on the pages we read without being held back until consent is given. | Free scan: category and severity only · Paid report: full detail |
| Unidentified Analytics Endpoint | France | Low | Art. 82 loi n° 78-17 (Informatique et Libertés) | We look for a script or request on the pages we read whose address names an analytics service we do not otherwise recognise, and we record whether it belongs to the site's own domain or to a third party. | Not evaluated in the free scan · Paid report: recorded as an observation, never as a finding |
| Legal Notice (Impressum) | Germany | Critical | § 5 DDG (Digitale-Dienste-Gesetz) + §18 Abs. 2 MStV (Medienstaatsvertrag) | We look for an Impressum page reachable from the pages we read; we do not check what it contains. | Free scan: category and severity only · Paid report: full detail |
| Cookie Consent Mechanism | Germany | Critical | § 25 Abs. 1 TDDDG (bis 2024: § 25 TTDSG) i. V. m. Art. 4 Nr. 11 und Art. 7 DSGVO (Maßstab der Einwilligung); Ausnahmen: § 25 Abs. 2 TDDDG; Bußgeldrahmen: § 28 TDDDG | Where the pages we read load a non-essential tracker, we look for a consent mechanism. | Free scan: category and severity only · Paid report: full detail |
| Data Protection Policy | Germany | Critical | DSGVO Art. 13, 14 (Informationspflichten) | We look for a data-protection notice (Datenschutzerklärung) reachable from the pages we read; we do not check what it contains. | Free scan: category and severity only · Paid report: full detail |
| SSL / TLS Encryption | Germany | High | DSGVO Art. 32 (Sicherheit der Verarbeitung) | We check whether the site answers over HTTPS at both spellings of its address, with and without www, and whether the certificate it presents is accepted when the connection is made. | Free scan: category and severity only · Paid report: full detail |
| Third-Party Data Transfers | Germany | High | DSGVO Art. 6 Abs. 1 + Art. 44 + LG München I Az. 3 O 17493/20 (Urteil vom 20.01.2022) | We look for fonts loaded from Google's font servers on the pages we read, rather than from the site's own server. | Free scan: category and severity only · Paid report: full detail |
| Unidentified Analytics Endpoint | Germany | Low | § 25 Abs. 1 TDDDG | We look for a script or request on the pages we read whose address names an analytics service we do not otherwise recognise, and we record whether it belongs to the site's own domain or to a third party. | Not evaluated in the free scan · Paid report: recorded as an observation, never as a finding |
| Privacy Policy (Notification) | Singapore | Critical | PDPA s18 & s20 (Notification Obligation) — Personal Data Protection Act 2012, as amended by the PDPA Amendment Act 2020 (effective 2 Feb 2021) | We look for a privacy policy or personal-data notice reachable from the pages we read; we do not check what it contains. | Free scan: category and severity only · Paid report: full detail |
| SSL / TLS Encryption | Singapore | High | PDPA s24 (Protection Obligation) — Personal Data Protection Act 2012 | We check whether the site answers over HTTPS at both spellings of its address, with and without www, and whether the certificate it presents is accepted when the connection is made. | Free scan: category and severity only · Paid report: full detail |
| Cookie Consent Mechanism | Singapore | Medium | PDPA ss. 13-14 (Consent Obligation); PDPC Advisory Guidelines on the PDPA for Selected Topics (revised May 2024), chapter on online activities and cookies | Where the pages we read load a non-essential tracker, we look for a consent mechanism and for a way of refusing offered alongside acceptance. | Free scan: category and severity only · Paid report: full detail |
| Overseas Data Transfers | Singapore | Medium | PDPA s.26 (Transfer Limitation Obligation) and s.13 (Consent Obligation) — Personal Data Protection Act 2012, 2020 Rev. Ed., in force 5 December 2025, read with the Personal Data Protection Regulations 2021, Part 3 (reg. 9–12), in force 2 March 2026. | We look for a Google Analytics tag that loads on the pages we read without being held back until consent is given — a request to a provider that may process it outside Singapore. | Free scan: category and severity only · Paid report: full detail |
| Data Protection Officer Contact | Singapore | High | PDPA s. 11(5) — an organisation must make available to the public the business contact information of at least one individual designated under s. 11(3). Manner of publication: Personal Data Protection Regulations 2021 (S 63/2021), reg 1A. Personal Data Protection Act 2012 (2020 Rev. Ed.). | We look for a published way of reaching the person responsible for data protection: a dedicated data-protection mailbox, or a data-protection role named next to an email address, telephone number, postal address or contact form. | Free scan: category and severity only · Paid report: full detail |
| Unidentified Analytics Endpoint | Singapore | Low | PDPA 2012 s. 13 (Consent Obligation) | We look for a script or request on the pages we read whose address names an analytics service we do not otherwise recognise, and we record whether it belongs to the site's own domain or to a third party. | Not evaluated in the free scan · Paid report: recorded as an observation, never as a finding |