$ audit --gdpr https://your-site.cz
We check your site before ÚOOÚ does
The Czech data protection authority (ÚOOÚ) inspects websites and, where it finds a breach, may impose a fine on their operators.
The audit goes through the site, checks it and points the problems out first — so you have the chance to put them right.
The audit normally covers up to 15 pages, which is enough in most cases.
Would you rather skip the detail?
I want a GDPR audit ↓What the audit covers
The audit is done from the visitor’s side, that is “from the outside”. We do not establish which tool or solution you have in place; we verify how your site actually behaves in a visitor’s browser. We check what data it stores and which third-party services it talks to before the visitor has made any choice, and whether that behaviour meets Section 89(3) of Act No. 127/2005 Sb., on electronic communications.
We also check the cookie bar itself separately, because this is where faults occur most often in practice. In particular we verify whether consent can be refused as easily as it is given, whether no options are pre-ticked, whether the look or layout of the bar does not steer the user towards a particular choice, and whether consent once given can easily be withdrawn afterwards.
We also pay attention to communication with third-party services. A site may load external scripts or pass data to third parties before the visitor has given the relevant consent.
You receive the results in a clear PDF report, usually within a week of your request.
What the law says
The most common failings are these.
Cookies are not in the first place a GDPR matter
The use of cookies is governed by Section 89(3) of Act No. 127/2005 Sb., on electronic communications. Since 1 January 2022, storing data on a user’s device, or accessing data already stored there, is possible only with the user’s prior demonstrable consent, save for the exceptions the Act provides. This duty covers data that are not personal data as well. The argument that a site processes no personal data through its cookies therefore does not by itself mean that the user’s consent is not required.
„Schválením novely zákona o elektronických komunikacích byly s účinností k 1. lednu 2022 odstraněny jakékoli nejasnosti, a provozovatelé internetových platforem mohou shromažďovat osobní údaje od návštěvníků pouze na základě jejich prokazatelného souhlasu, podle principu opt-in.“
The exemption is narrower than people expect
Without consent, only cookies that are necessary to transmit a message over an electronic communications network, or to provide a service the user has explicitly requested, may be used. Typically that means cookies needed for a shopping basket or for a user’s login. Cookies used for traffic measurement, marketing or tracking user behaviour generally do not fall under these exceptions.
„Výjimku představují pouze tzv. technické cookies, které jsou nezbytné pro správnou funkci internetových aplikací.“
„Nejednalo se tedy o technickou cookie, která je nutná k samotnému fungování webové stránky a kterou je v rámci zákonné úpravy možné používat nezávisle na vůli návštěvníka webových stránek.“
Fines for letting it slide
Storing non-technical cookies without the user’s prior consent may constitute a breach of the duties in processing personal data, including the lawfulness principle in Art. 5(1)(a) GDPR. A breach of the basic processing principles may be penalised under Art. 83(5) GDPR, which sets the upper limit of an administrative fine at 20 million euro or, for an undertaking, up to 4 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. (That is the statutory ceiling for a breach of the GDPR principles named; the actual amount depends on the circumstances of the individual case.) In practice such a failure can be the result of insufficient control over how the website is set up and how it works.
„Vzhledem k tomu, že výše uvedený jeden soubor cookie instalovala obviněná do koncových zařízení subjektů údajů bez jejich souhlasu, porušila tím § 89 odst. 3 zákona č. 127/2005 Sb. a tedy – ve vztahu k osobním údajům, které byly prostřednictvím tohoto souboru cookie získány – zásadu zákonnosti ve smyslu čl. 5 odst. 1 písm. a) nařízení (EU) 2016/679. Porušením zásady zákonnosti jakožto jedné ze základních zásad zpracování osobních údajů se obviněná dopustila přestupku podle § 62 odst. 1 písm. b) zákona č. 110/2019 Sb.“
Non-technical cookies must not be stored before the visitor has chosen
Consent first, non-technical cookies only after it. One of the most frequent failings is a cookie bar that is displayed on the page while analytics and marketing cookies are already being stored as it loads, that is before the user has made any choice. The bar then does not serve its purpose, because consent given only after the cookies were stored cannot constitute the user’s prior consent.
„před odsouhlasením/neodsouhlasením cookie lišty byly nastaveny netechnické cookies, včetně marketingových a analytických;“
Refusing must be as easy as accepting
The requirements for valid consent follow chiefly from Art. 4(11) and Art. 7 GDPR. Problematic cookie-bar settings include, for instance, the absence of an equal option to refuse consent in the same layer, pre-ticked or otherwise pre-selected options, or a refusal hidden behind a “Settings” button. A graphic design of the bar that unduly suppresses the refusal in comparison with giving consent can be problematic too. The user must also be able to withdraw consent at any time, and withdrawing it must be as easy as giving it.
„Aby měl subjekt údajů možnost svobodné volby, musí být odmítnutí souhlasu stejně jednoduché jako jeho udělení, čehož je dosaženo umístěním tlačítka pro udělení souhlasu a pro nesouhlas s netechnickými cookies do stejné vrstvy cookie lišty.“
„Předem zaškrtnutá políčka nelze považovat za souhlas v souladu s obecným nařízením. Ke stejnému závěru dospěl i Soudní dvůr EU ve svém rozhodnutí ve věci Planet49 GmbH (C 673/17).“
„Umístění možnosti volby pro „souhlas“ a „nesouhlas“ se zpravováním osobních údajů prostřednictvím souborů cookies do různých vrstev v rámci cookies lišt, kterým je návštěvník cíleně ovlivňován, aby souhlas udělil (tzv. DDP – Deceptive Design Pattern / Klamavý designový vzor);“
„Nemožnost (či výrazné zkomplikování možnosti) odvolat souhlas se zpracováním osobních údajů prostřednictvím cookies souborů;“
Closing the bar is not consent, and entry must not be conditional on it
Merely closing the cookie bar with a cross, or continuing to use the site, cannot be taken as giving consent. Consent must be the result of an active and unambiguous act of the user. Making access to the site conditional on consent to non-technical cookies (a “cookie wall”) is problematic as well, because consent obtained that way may not meet the requirement of being freely given.
„Uživatel musí svůj souhlas jednoznačně vyjádřit. Je-li možnost lištu zavřít, aniž by uživatel vyjádřil, zda souhlas uděluje, nelze její zavření a následné setrvání na internetových stránkách považovat za souhlas.“
„V bodě 39 Pokynů EDPB č. 05/2020 je v souvislosti s požadavkem na svobodný souhlas uvedeno, že přístup ke službám a funkcím nesmí být podmíněn souhlasem uživatele s uchováváním informací nebo získáním přístupu k již uloženým informacím v koncovém zařízení uživatele (tzv. cookie walls).“
The full ÚOOÚ documents we quote from (in Czech):
What can happen to you
Above are a few basic rules every website should meet. If you want to know how yours is doing, we will gladly run the audit for you. Just fill in the form below.
120+
written warnings ÚOOÚ sent to site operators before it started issuing fines.
4 443 000 CZK
in cookie fines, which the authority reported in August 2023.
898 000 CZK
the largest single fine — for marketing cookies loaded without the visitor’s consent.
Using a cookie-bar tool does not in itself guarantee compliance
In decision ref. UOOU-02808/22-7 the site operator had the Cookiebot consent-management tool in place. Its mere use did not ensure the site was set up correctly: non-technical cookies were stored before the user’s choice, a marketing cookie was classified as technical, and some cookies had a lifetime of two years. Deploying an external tool therefore did not relieve the operator of responsibility for how the site actually worked.
Our audit therefore does not only check whether you have a cookie bar or which tool you use. We measure what your site actually does in a visitor’s browser, regardless of the consent-management solution in place.
What you get
A report as PDF
The findings ordered by severity, each with the relevant legal provision stated.
Split into proven and to be verified
We clearly distinguish what we demonstrably measured from what has to be verified separately. Whether a particular cookie is really necessary, for example, cannot always be judged from the outside alone — its purpose may depend on the site’s internal workings and implementation.
No obligation and no conditions
An audit of up to 15 pages of your site is entirely free and carries no follow-up obligations. You receive the results together with an overview of the findings and the possible remedies. What you do with them is up to you. If you decide to address the shortcomings found, we will gladly help.
What the audit cannot do
The audit assesses the site from its visitor’s point of view. It therefore sees only what can be established in the browser — it does not examine code running on the server, internal systems, or what you subsequently do with, say, the data collected through forms.
Nor is the audit a legal opinion. It describes what we found when checking the site and states the legal provisions the finding may concern. A final legal assessment of a specific situation may require further information that measuring the site alone cannot provide.
I want a website audit
Fill in the form and we will get back to you.