Skip to content
DEEN

5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026

Have your website reviewed for GDPR compliance

Text, banner and technology must describe the same reality.

A GDPR-compliant website takes more than a privacy policy. We review whether cookie banner, tracking, forms, newsletter, third-party providers and privacy notices actually fit together.

Enquire without a URL

Initial contact is free of charge. You will be informed expressly before any costs arise.

Response on working days within 24 hoursData protection law at ITMR

As of: 23 October 2026

Schematic illustration of a typical banner. Text and domain are simplified and do not replace a review.

We review websites for

  • Companies
  • Shops
  • SaaS providers
  • Agencies
  • Platforms

Key points at a glance

  • In a GDPR website review, we at ITMR compare the privacy policy, cookie banner, tracking, forms and third-party providers with the technology actually running.
  • Cookies and comparable access to end devices are governed by § 25 TDDDG, and the processing of personal data by the GDPR.
  • You receive a prioritised list of measures and, on request, a privacy policy that fits your specific setup.
  • You decide on implementation together with your agency, IT and marketing.
  • Your contact is Dominik Skornia and his team. He is an AI-Privacy-Expert (GDDcert. EU). Response on working days within 24 hours.
DSGVO
The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
SaaS
Software as a Service. Software used over the internet rather than installed.
AVV
Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
Third country
A state outside the EU and the EEA. Data transfers there need a special legal basis.

Reason for instruction

When does website data protection hold up?

A privacy policy can look good on paper and still not match the website.

Risks arise before a relaunch, an ads launch, a tool change, a customer audit or after a complaint.

It becomes critical when consent banners, tracking, forms, newsletters, plug-ins, shop functions or application flows process data that is not described properly in the text or is controlled differently in the technology.

We review your website setup legally along the real data flows. Which tools are running? Which consent is needed? Which notices are missing? Which providers have access? And which adjustments must be prioritised before release, campaign launch or a management decision?

Many companies do not need another abstract GDPR summary. They need an answer to a specific situation: can this website stay live as it is? Can the campaigns start? Does the banner need to change? Is the privacy notice sufficient? Do the agency, IT or marketing need to rework things first?

That is what the review is designed for: not legal completeness for its own sake, but an actionable line of measures for the website you actually run.

Cookie banner
Choice, categories, start time
Tracking
Google, Meta, LinkedIn and others
Forms and newsletter
Contact, application, sign-up and proof
Third-party providers
Roles, storage locations, sub-processors
Privacy policy
matching the tool set

Approval instead of cosmetic text changes

Generators deliver text modules. They do not clarify whether the website works the way the text claims. We start where questions arise later.

How it works

How is the privacy policy created in three steps?

After your enquiry we will respond on working days within 24 hours.

  1. 01

    Submit your setup

    URL, privacy policy, consent banner, a list of tools and short notes on forms, newsletter, tracking, shop, application flow or CRM integration are enough to get started.

    URL
    Home page and shop
    Tools
    Analytics, pixels

  2. 02

    Classify risks

    We review whether GDPR, TDDDG, consent banner, third-party providers, legal bases and privacy policy match the actual website practice. We separate urgent points from later optimisations.

    • Bannercritical
    • Server logsfits

  3. 03

    Receive documents

    Privacy policy, banner control and list of measures are prepared so that website, marketing and data protection follow the same line.

How long does it take? Most work steps are completed within a few working days. How quickly it goes depends on the scope and on your feedback. Do you have a fixed date, such as a launch? Tell us when you send your enquiry and we will plan for it. Is the launch or relaunch of a website, shop or app still ahead? Then our data protection set-up.

Scope

What does the GDPR website review include?

Service package: GDPR website

  1. Risk classification

    Classification of the main data protection and consent risks of your website.

  2. Points to adjust

    Specific points for the privacy policy and banner.

  3. Third-party providers and forms

    Notes on third-party providers, tracking and form flows.

  4. Priority list

    What is critical, what must change before going live, what should be documented and what can wait for a later optimisation? As a list for agency, marketing, IT or data protection.

  5. Privacy policy

    A privacy policy aligned with your specific setup, not with a template.

For whom
Companies, shops, SaaS providers and platforms with their own website
Legal framework
GDPR and § 25 TDDDG
First response
on working days within 24 hours
Initial contact
free of charge, to clarify the topic, responsibility and next step
Costs
We inform you expressly in advance. Only then do you decide.
Not included
Review of data processing agreements, data transfer review, data protection audit and technical implementation in the CMS. These are separate services, on request and as needed.
Have the website reviewed

Who delivers what and who decides

What you provide
  • URL and relevant subpages
  • Current privacy policy
  • Screenshots of or access to the consent banner
  • List of tools and plug-ins
  • Note on newsletter, shop, applications, chat, appointment booking or CRM
For more complex setups
  • Agency or tool documentation
  • Consent management configuration
  • Tracking plan or tag manager container
  • DPAs of relevant providers
  • Internal approval or audit requirements
Who decides
  • You, on implementation and timing
  • Agency and IT, on the technical solution
  • In a dispute, the supervisory authority or a court

How does instructing us work?

  1. 1
    Initial assessment

    We review your information and tell you whether the package fits or another route makes more sense.

  2. 2
    Offer for the package

    If the package fits, you receive an offer for the review, privacy policy and list of measures. We only start once you agree.

  3. 3
    Court steps separately

    Proceedings before the supervisory authority or in court, and representation in them, are not part of the package. We agree these steps separately.

Typical triggers

When should companies have their website reviewed?

Six situations in which, in our experience, the review is needed particularly often.

  1. Relaunch or campaign launch

    The website is about to go live, ads are about to start or a new agency has integrated tools. Before release it must be clear whether banner, tracking and notices are sufficient. For a go-live, our launch board for digital projects bundles the legal review points.

  2. Tracking is running, but approval is missing

    Google, Meta, LinkedIn, HubSpot or other marketing tools are integrated. The question is whether they are legally explained, controlled and documented.

  3. Cookie banner does not deliver a robust approval

    The banner looks professional, but services start too early, categories stay too broad or reject and accept are not implemented equally.

  4. Privacy policy does not match the technology

    New services are missing, old providers are still in the text or the description is so general that marketing, IT and data protection cannot see a clear line.

  5. Enterprise customer or investor asks

    Before procurement, due diligence, enterprise sales or an audit, the website must be explainable in a way that stands up to review.

  6. Complaint, warning letter or regulatory attention

    If a specific allegation is on the table, template texts do not count. Facts, technical status, external communication and corrective measures must then fit together.

Review scope

What is part of the GDPR website review?

Your public presence only becomes robust when technical implementation, information obligations, consent, third-party providers and internal responsibilities describe the same reality.

Data flows and cookie banner
  • Forms, appointment booking, shop, login Contact form, application form and login area.
  • Server logs and basic services Security functions and basic technical services.
  • Newsletter, lead flows, CRM Including marketing automation.
  • Access to end devices under § 25 TDDDG Separating necessary functions from services that require consent.
  • User decision and proof Design of the choice and demonstrability of consent.
Tracking, analytics and marketing
  • Analytics, ads, pixels, Insight Tag Google Analytics, Google Ads, Meta Pixel, LinkedIn Insight Tag or comparable services.
  • Retargeting and conversion tracking Profiling and third-party access.
  • Campaign approval and advertising law Alignment with CRM processes and advertising law.
Privacy policy and transparency
  • Controllers, purposes, legal bases And recipients of the data.
  • Retention, rights, third countries Retention periods, data subject rights, third-country links and withdrawal options.
  • Text, banner and tool setup consistent Alignment between text, consent banner and actual setup.

Privacy policy

Have your privacy policy reviewed or newly drafted?

The privacy policy is the part of your website that visitors, competitors and supervisory authorities read first. It must be complete and describe exactly what actually happens on your website.

Review the existing policy

You already have a privacy policy, for example from an agency or a generator. We check it against your live website: are tools, providers, legal bases, retention periods and third-country transfers correct? You receive a list of points that are missing, wrong or outdated and, on request, the corrected version.

Draft a new policy

For a relaunch, a new website or many open points, we draft the privacy policy from scratch. It is based on your actual setup: hosting, cookie banner, analytics, forms, newsletter, applications, embedded content. Clearly worded, without modules for services you do not use at all.

Keep it up to date

New tools, a change of agency or new functions quickly make a privacy policy incomplete. On request, we agree with you which changes require the text to be adapted and who reports them internally.

Legally, the content follows mainly from Art. 13 and 14 GDPR: who is responsible, which data is processed for which purpose and on which legal basis, who receives it, how long it is stored and which rights data subjects have. For cookies and similar technologies, information on consent under § 25 TDDDG is added.

A privacy policy is only as good as its alignment with the technology. As lawyers for data protection law, we therefore never review the text in isolation, but together with the cookie banner and data flows.

What we often find when reviewing privacy policies

  • Listed tools no longer run, running tools are missing.
  • “Legitimate interest” as the legal basis, although the banner asks for consent.
  • No or only general information on retention periods.
  • US transfers without reference to the legal basis, such as the EU-US Data Privacy Framework.
  • Contact details of the data protection officer are missing, although one has been appointed.
  • The policy cannot be reached with one click from every page.

Review or new version? Send us the URL and your current privacy policy. We tell you which makes more sense and what it costs before any costs arise.

Risk points

What makes website setups legally vulnerable?

Four patterns we regularly find in reviews.

The text is cleaner than the website

The privacy policy sounds plausible but no longer matches the running tool set. The gap becomes visible when tracking, form providers, newsletter, chat or application flows were added later.

The banner promises a choice that does not work technically

Services start before consent, categories stay too broad or rejecting takes more effort than accepting. What matters is the link between the user's decision and technical control.

Agency, marketing and data protection decide separately

The agency works to performance, marketing to campaign goals and data protection to the state of the documents. The review brings these levels together.

Third-party providers are treated as mere tool names

For analytics, video, map, chat, applicant or CRM services, what counts is roles, purposes, storage locations, sub-processors, consent control and a clear description in the privacy policy.

Official guidance

Which laws apply to website data protection?

For company websites, what matters most are the GDPR's transparency obligations and consent for access to terminal equipment under § 25 TDDDG.

The GDPR covers the processing of personal data. § 25 TDDDG applies earlier, when information is stored on or read from end devices. In our experience, both levels often interlock with tracking.

In addition, the standards of the supervisory authorities on digital services, cookies and similar technologies apply.

Sources

Classification

When does this service fit, and when does another?

The review is the right starting point when your public website is the focus. For broader questions, other routes get to the core faster.

  1. 1
    Overarching GDPR compliance

    Contact with authorities, data subject rights, data breaches and data protection organisation belong to data protection law.

  2. 2
    Processes rather than the website

    If processes, documentation, roles and service providers are to be reviewed, the data protection audit is the right fit.

  3. 3
    Shop focus

    If checkout, terms and conditions, cancellation policy or platform obligations are the focus, the e-commerce route is closer.

Typical mistakes in website data protection

  • Privacy policy from a generator without checking it against the technology.
  • Services load before consent.
  • Rejecting is harder than accepting.
  • Old providers remain in the text, new ones are missing.

Your contact

Dominik Skornia, LL.B.

Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer

View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124

At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.

ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.

What clients say

5,0 von 5 · 167 Google reviewsPeriod: October 2016 to date · As of: 28 October 2026

5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026

“Because of an unjustified block, I called in the law firm for help. … Everything was taken care of excellently and the case was settled after two months.” (translated from German)
E Conzept · Google
“A great first conversation with excellent tips. Very helpful and very likeable. Many thanks!” (translated from German)
L. H. · anwalt.de (opens in a new tab) · 02.12.2025 · “Excellent advice” (translated from German)
“He and the ITMR team handle various matters for us relating to cold acquisition, contract law (B2C and B2B), receivables management, trademark law and trademark protection. … A market participant infringed our trademark rights. … Two hours later the cease-and-desist declaration was with the other party.” (translated from German)
Kai Gerrit Krause · Google

FAQ

Frequently asked questions about the GDPR website review

Is a privacy policy from a generator enough for a company website?

For very simple cases, a generator can be a starting point. But it does not replace a review of whether the actual tools, forms, tracking services, provider chains and consent settings are captured correctly.

When should a website be reviewed before a relaunch?

Before release, especially when new tracking tools, newsletter flows, application forms, shop functions, chat or appointment booking systems are integrated. The earlier these points are clarified, the easier they are to translate into agency and technical processes.

Is the review only about cookies?

No. In our experience, cookies are often the most visible part. Privacy notices, legal bases, forms, server logs, newsletters, third-party providers, international access, withdrawal options and internal responsibilities also count.

Does every tracking tool need consent?

That depends on the specific access, purpose and service. For marketing, retargeting and many analytics set-ups, consent is a central review point. What matters is the technical function; the tool name is secondary.

Source: § 25 TDDDG

What is the difference between the GDPR and the TDDDG for websites?

The GDPR covers the processing of personal data. § 25 TDDDG applies to storing information on or reading it from end devices, for example via cookies.

Can you also draft a new privacy policy?

Yes. This makes sense once it has been clarified which functions, providers, purposes, legal bases and consent processes actually exist. The text is then aligned with the specific setup.

What if the agency has already installed the cookie banner?

Then we review whether the configuration matches the legal assessment. Categories, button logic, start time of services, withdrawal option, documentation and alignment with the privacy policy are important.

Does the review also suit shops, SaaS websites and platforms?

Yes, if website data protection, tracking, consent and privacy notices are the focus. If checkout, terms and conditions or platform obligations are the focus, the e-commerce route is also closer.

What does it cost to have the privacy policy reviewed?

That depends on the size of the website, the number of tools and whether it is only reviewed or also reworded. After a short initial assessment you receive an offer. Costs only arise once you agree.

Review or redraft: which makes more sense?

If the basic structure is right and only individual services have changed, a review with corrections is usually enough. For a relaunch or many gaps, a new version is often faster and cleaner.

Can I receive a warning letter because of a faulty privacy policy?

It happens. Whether a warning letter is justified in the individual case is legally disputed. If you have already received one, see our defence against warning letters.

How often should the privacy policy be updated?

With every change to tools, providers or forms, and in addition at least once a year as a check.

Next step

Clarify website data protection before going live or an audit

If cookie banner, tracking, third-party providers, forms and privacy policy do not work together, a risk arises that quickly becomes visible to the outside world. An early review creates a clear line for management, marketing, agency, IT and data protection.

Useful for your enquiry

  • Website URL
  • Current privacy policy
  • Tracking and marketing tools
  • Screenshot of the consent banner
  • Planned go-live or reason for the review

Our Website Legal UX Heatmap shows, as a click map, which areas of a website most often carry risks.

Request a GDPR website review

Give us the URL and briefly which tools and forms are running.

Your contact details

Your message

e.g. deadline from an Abmahnung (formal warning letter)

Helpful are the URL, privacy policy, tools and planned go-live.

Related services

From our blog: Tracking without consent · GDPR warning letter from a competitor · BFSG 2026