Website Legal UX Heatmap
Not a scanner but a practical click plan: select website areas such as header, footer, checkout, cookie banner, product page, newsletter, contact form, careers, reviews and social embeds. The heatmap shows where legal texts, consent, accessibility under the BFSG, data protection, competition law and warning letter risks are particularly likely to meet. This lets you review your website's legal risks in a targeted way.
- For entrepreneurs
- For agencies
- For relaunch & go-live
- GDPR · TDDDG · UWG · BFSG
Value of the tool: The heatmap helps you see legal UX risks not abstractly by statute but specifically by website area. This makes typical weak points in cookie banners, checkout, forms, reviews, newsletter sign-up, accessibility and footer legal texts quick to prioritise.
Clickable website heatmap
Click on the areas your website contains or that should be reviewed in the relaunch. The selection is carried over into the questionnaire and feeds into the risk assessment.
How the UX risk plan works
The review looks at the website from the perspective of users, authorities, senders of warning letters, data protection supervisory authorities, accessibility requirements and internal legal QA.
Identify the website model
Shop, SaaS, lead generation, content, careers and social proof create different duties.
Mark UX zones
The heatmap shows which areas should be reviewed legally.
Prioritise risk signals
Consent, checkout, newsletter, forms, reviews and embeds are weighted by warning letter and compliance pressure.
Prepare evidence
The short overview provides a copyable basis for the agency, management, data protection and legal review.
What this check does
The check does not replace a technical crawler or legal advice. It does, however, structure typical legal UX risks so that entrepreneurs, agencies and project teams know more quickly before a relaunch, campaign launch or go-live where an in-depth review makes sense.
Which areas of law are typically affected?
Depending on the website area, this concerns in particular the GDPR and TDDDG for tracking and forms, unfair competition and price indication law for advertising and product pages, consumer law under the Civil Code for checkout and subscriptions, accessibility under the BFSG for digital offerings, DSA/platform issues for user content, copyright and media law for embeds, images and reviews, and warning letter and litigation readiness.
Why is a review by website area useful?
Many risks arise not from the legal text alone but from the interplay of UX, button text, mandatory information, consent flow, form logic, tracking, product claims and evidence. A heatmap shows these interfaces more clearly than a purely abstract list of provisions.
Where are the limits?
The tool does not automatically check source code, cookie scripts, accessibility errors or specific legal texts. It provides an initial prioritisation. For binding measures, screenshots, tool lists, legal texts, consent logs, checkout flows and campaign materials should be reviewed individually.
Assess website risk interactively
Answer the questions as realistically as possible. Unclear points are deliberately treated as increasing the risk, because unreviewed UX details in particular often lead to warning letters, data protection problems or go-live delays.
Step 1 of 6Website legal UX risk
Likely assessment
Next focus
Reasons
Recommended next review points
Documents worth preparing
Copyable short overview for your inquiry or project team
Typical risks, deadlines and measures
The following points show common legal UX risk areas. Whether they actually apply depends on the business model, the users, the tools used and the actual website flow.
| Website area | Typical risk | Orientation | Sensible measure |
|---|---|---|---|
| Cookie banner / tracking | Tracking or terminal device access without valid consent. | The GDPR and TDDDG apply permanently; consent must be traceable and revocable. | Review the CMP audit, tool list, consent log and two-click solution for embeds. |
| Checkout / subscription | Unclear payment obligation, term, withdrawal or cancellation button. | In B2C, button and cancellation button errors can be directly relevant to contracts and warning letters. | Document the final order page, button text, price information, withdrawal and cancellation flow with screenshots. |
| Forms / careers | Too much data, unclear purposes, sensitive uploads or recruiting tools. | Data subject requests must generally be answered within one month; personal data breaches can trigger 72-hour deadlines. | Reduce mandatory fields, update privacy notices, review the upload and deletion concept. |
| Product page / advertising | Unsubstantiated claims, green claims, price or review presentation. | Unfair competition, price indication and claim risks are continuously relevant; since 27 September 2026, the EmpCo bans on generic environmental claims, uncertified sustainability labels and climate neutrality claims based on offsetting apply under the UWG. | Create a claim dossier, approval process, price/unit price check and review evidence. |
| Accessibility / UX | User flows that cannot be operated by keyboard, have low contrast or are inaccessible. | The BFSG has been relevant for affected products and services since 28 June 2025. | Plan a test based on WCAG/EN 301 549, an accessibility statement and a defect process. |
| Footer / legal texts | Outdated provider information, privacy policy, terms, withdrawal or dispute resolution. | Legal texts must match the actual website, tools, services and target group. | Carry out a legal text review against current tools, business model, tracking, consumer information and internal links. |
Sensible next steps
Related ITMR checkers and follow-up reviews for websites, relaunches, shops, lead flows and digital business models.
Examines checkout, withdrawal, prices, cancellation button and typical shop warning letter risks.
Checks consent, double opt-in, advertising to existing customers, unsubscribe and evidence.
Helps with high-risk data processing, tracking, profiling, HR tools and sensitive data.
Classifies product, sustainability, price and performance claims with evidence requirements.
Structures legal approval before a relaunch, campaign, product launch or new conversion flow.
Supports you when a warning letter, complaint, deadline or platform notice has already been received.
Prioritise your website, shop or relaunch legally?
For a specific review, the following are particularly helpful: website URL, screenshots of the cookie banner and checkout, tool list, legal texts, form flows, newsletter process, campaign claims and the desired go-live date.
Send inquiry to ITMRLegal orientation note: This checker provides an initial structured orientation and does not replace a legal review of the individual case. The assessment may differ depending on the business model, target group, tools used, actual UX, legal texts, evidence and current practice of authorities or courts. Background on a legally compliant website can be found under Check website data protection; for shops and legal texts, take a look at Drafting terms and conditions.