State of GDPR Website Compliance: What 636 Real Scans Found

Every number below is drawn from 636 completed scans (out of 641 attempted — a 99.2% completion rate) run through GetGDPRScan's GDPR module. Each scan renders the target page, extracts structured signals, and evaluates them against a fixed set of GDPR-related checks — the same mechanism described in How Website Compliance Scanning Actually Works. No scan target URLs, IP addresses, or other identifying information are included in or derivable from this report — only aggregate counts.

Filtering out informational and "not applicable to this site" findings, these are the actual compliance gaps that showed up most often:

Two findings are easy to misread if you only look at raw frequency. "No cookie banner detected" showed up on 23.3% of sites — but the scan flagged this as informational in almost all of those cases, meaning it determined a banner wasn't required because the site wasn't setting non-essential cookies in the first place. The real violation — a cookie banner that's required but missing — was notably rarer, appearing on well under 2% of sites.

Similarly, "no privacy policy" appears twice in the data with opposite meanings: 5.3% of sites had no privacy policy but the scan determined none was required for that site's data practices (informational), while a separate 3.3% were missing a privacy policy the scan determined actually was required — that second number is the one that represents real exposure.

About a third of scans (32.7%) found no issues at all. Of the 177 sites where a cookie banner was detected, 95.5% included a working reject option rather than an accept-only design — accept-only banners, a well-known dark pattern, were the minority, not the norm, in this sample. A small number of sites (1.9%) were specifically confirmed to have tracking scripts correctly blocked pending consent, which the scan treats as the compliant reference behavior, not a flaw.

Grouping flagged items by category (not every flagged item carries a category tag, so these percentages are a lower bound): transparency-related issues appeared in 35.8% of scans, data-collection issues in 26.1%, third-party service disclosures (fonts, reCAPTCHA, and similar) in 23.1%, and tracking-related issues in 19.8%.

Average risk sub-scores, on a 1–10 scale where higher means more risk factors triggered, stayed low across the board: 2.0 for tracking, 2.0 for data collection, and 1.6 for transparency — consistent with most sites triggering only one or two risk factors rather than accumulating many.

12.3% of completed scans required a full Playwright browser render rather than a simpler HTML fetch — typically triggered by JavaScript-heavy pages, bot-blocking, or low-confidence results from the faster path. See How Website Compliance Scanning Actually Works for why that distinction exists.