DSGVO-Wächter records what happens when one of your own pages loads: which third parties are contacted, which cookies and storage entries appear and which security headers are missing – each with its offset from the page start. Built as a regression test before every deploy.
The consent banner is in place, the privacy policy is written, the analytics snippet was removed. And yet something still loads on page view – an embedded video, a font from a CDN, a script from an old theme. You cannot reliably see this in the source, and in the network tab it disappears between a hundred other lines.
DSGVO-Wächter answers exactly one question: what actually happens when someone opens the page for the first time? The most important value in the report is the time offset – if a service loads after 180 ms, no consent can have been given.
Enter the address, choose the observation period, hit start. The extension handles the rest.
The tab is attached to the DevTools protocol and the HTTP cache and service worker are switched off – otherwise a PWA's own service worker answers everything from cache.
Optionally, the domain's cookies are deleted beforehand. Only if you tick the box – otherwise everything stays as it is.
The page is loaded and every request is logged together with its offset from the page start.
After the observation period, localStorage, sessionStorage, cookies, links and consent elements are read out.
The result opens as its own page and can be copied or saved as Markdown. The last 20 runs are kept locally.
Five areas that together give the full picture – from the first request to the mandatory link in the footer.
Every external domain contacted, with the service behind it, the number of requests, the type and the first contact in milliseconds.
Cookies, localStorage and sessionStorage – including the entries written without any cookie banner that still fall under § 25 TDDDG.
Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy, clickjacking protection and Permissions-Policy – each with the value that is missing.
If a service requiring consent starts without a consent dialog being found, that is the most serious finding in the report.
Checks whether a legal notice and a privacy policy are linked from the page being tested.
The result can be copied or saved as Markdown – for tickets, handovers or your own documentation.
Every finding gets a level. The overall rating equals the most serious individual finding.
| Level | Meaning |
|---|---|
| critical | Unlawful without consent, or a mandatory disclosure is missing |
| high | Legally contestable, a rebuild is needed |
| medium | Should be fixed – security or transparency |
| note | Documentation duty or optimisation |
| ok | Detected, uncritical |
New services can be added through a single file – one entry per service with its pattern, severity and note.
A testing tool is only useful if it is clear where it stops. These four points are part of it.
One single page load is tested. Trackers that only load after a click on "Accept all" deliberately do not appear – that is precisely the desired state.
During the test, Chrome reports that the browser "is being controlled by a debugger". That is the recording itself, not a fault.
Mapping a host to a domain uses a shortened public suffix list rather than the complete one. In edge cases a domain can be grouped incorrectly.
The report shows technical facts and classifies them according to common practice. It does not decide whether a finding is unlawful in a specific case.
The extension runs entirely locally in your browser. There is no server, no account and no data transfer to us.
Drop us a line – we will get back to you with the details on DSGVO-Wächter.