- Meta pixel loads before consentArt. 5(3) ePrivacy Directive
- Product photo without alt textDirective (EU) 2019/882, the EAA
- Reviews with no word on whether they are genuineArt. 7(6) Directive 2005/29/EC
- Chat window without an AI noticeArt. 50 AI Act
- No company registration number foundArt. 5 e-Commerce Directive, art. 6 Directive 2011/83/EU
We look at your site the way a regulator does: from outside, without clicking anything. Which cookies are set before your visitor chooses, whether your registration number and the right of withdrawal can be found, whether your reviews and your chat window say what they have to say, and how accessible your pages are.
Measured from Dublin, inside the EU: cookie banners behave differently per country. We click nothing, so everything that loads, loads before your visitor’s choice.
Which rules apply to you?
All five come from EU law and apply across the EU. But not every rule applies to every shop. The cookie rules and your business details apply to everyone, even if you work alone. Accessibility is usually only mandatory from ten people.
Cookies before consent
Art. 5(3) ePrivacy Directive
An EU directive, for the whole EU
Who it applies to
Every website. The rule has no lower limit.
What we measure
Which cookies, trackers and browser storage are present before your visitor chooses, and whether refusing is as easy as accepting.
What the law asks: Cookies before consentYour business details
Art. 5 e-Commerce Directive, art. 6 Directive 2011/83/EU
EU directives, for the whole EU
Who it applies to
Every business website. If you sell to consumers, you have to state more.
What we measure
Registration and VAT number, geographic address, direct contact, terms, privacy statement, the right of withdrawal and the withdrawal button, including on your contact and terms pages.
What the law asks: Your business detailsCustomer reviews
Art. 7(6) Directive 2005/29/EC
An EU directive, for the whole EU
Who it applies to
Anyone who shows customer reviews.
What we measure
Whether your reviews say whether and how you check that they come from customers who actually bought the product.
What the law asks: Customer reviewsA chatbot with AI
Art. 50 AI Act
An EU regulation, directly applicable across the EU
Who it applies to
Anyone with an AI chat on their site. The duty lies with the provider of the chatbot.
What we measure
Whether the chat window tells the visitor they are talking to an AI. Whether a person or a model is behind it, we cannot see: you get a question, not a verdict.
What the law asks: A chatbot with AIAccessibility
Directive (EU) 2019/882, the EAA
An EU directive, for the whole EU
Who it applies to
From ten people, or more than two million euros in both turnover and balance sheet total, when selling to consumers.
What we measure
Seventy WCAG rules at level A and AA, plus four tests an ordinary checker does not do: sideways scrolling at 320 pixels, visible and obscured focus, and wider text spacing.
What the law asks: Accessibility
What happens before your visitor chooses
Anyone looking at their own site clicked ‘accept’ long ago. What a new visitor goes through in the first few seconds, the owner therefore never sees. A regulator with a scanner does.
Art. 5(3) ePrivacy Directive. Anything not strictly necessary, only after consent. Regulators can measure this with software: the European Data Protection Supervisor even publishes its own inspection tool.
- 0.0 sYour visitor opens the homepage
- 0.4 sGoogle Tag Manager loads. That is allowed, as long as it stores nothing.
- 0.9 sHotjar sets the cookie _hjSessionUser
- 1.3 sThe Meta pixel sends a request to Facebook
- 2.1 sThe cookie banner appears
The visitor has not chosen anything yet.
The banner is there, but Hotjar and the pixel got there first. The report shows which trackers, cookies and browser storage were present before your visitor could choose, and which service they come from.
For every finding: what is wrong, who fixes it, and how
No score, but the element on the page, with the change that fixes it. If you can do it yourself in your admin panel, the report says so. Otherwise you pass it to your web developer with one button.
Who fixes it
Next to the criterion, with the finding still closed. The first question is always: can I do this myself?
The change
Real HTML, in your own source code. No widget laying a layer over the top.
Pass it on
One button puts the whole report on your clipboard as plain text, ready for an email to your web developer.
Image without alternative text
12× on 3 pages
WCAG 1.1.1, Non-text Content (level A)You can do this
This image has no text alternative. Blind and partially sighted visitors hear nothing, or only a file name. For a product photo that means: no idea what is for sale.
How to fix this
Give the image an alt that says what is on it: <img src="/media/summer-dress-blue-38.jpg" alt="Blue short-sleeved summer dress, size 38">. For a product photo, the product belongs there, not ‘photo’ or the file name.
Mainly affects visitors who use a screen reader or voice control, an estimated 2% of your visitors.
main > .product-grid > article:nth-child(3) > img
<img src="/media/summer-dress-blue-38.jpg" class="product-image" loading="lazy">What a machine cannot see from outside
That is why we never call anything ‘compliant’. We measure what happens; whether it is allowed is for you to judge, with an adviser if needed. A clean report means we found nothing, not that there is nothing.
What we measure
- Which cookies, trackers and browser storage are present before the visitor’s choice.
- Whether your registration number, address, terms, right of withdrawal and withdrawal button can be found anywhere on your site.
- What can be established about accessibility from the structure of a page: 30 to 40 per cent of the criteria.
What we cannot see
- Whether a cookie is really necessary, and what happens to the data.
- Whether a number belongs to your business, and whether your terms are sound.
- Whether an alt text describes what can be seen, and whether an order can be placed with a screen reader.
- Whether a person or a model is behind your chat window.
Your site changes, even if you do nothing
A single scan is a snapshot. What makes a subscription worth something is what changes afterwards without anyone telling you. That is why we look every day.
Someone adds a pixel in Tag Manager
For a campaign, and the pixel loads before consent. The web developer knows nothing about it.
An update removes the reject button
A new version of your theme or cookie plug-in, and the banner only offers ‘accept’.
The chat vendor switches on AI
In the same window, under the same name. Since 2 August 2026 that needs a notice.
The record
Every measurement goes into your record with a date, naming what was added and what was fixed. That is what you show a regulator or a client.
An email as soon as something new appearsIn development
- 3 JulyFirst measurement: 14 findings.
- 3 AugustAdded: a TikTok pixel before consent.
- 3 SeptemberFixed: the pixel, and six images without alt text.
Pricing
The scan is free. You pay for the watch: a daily look at what loads before consent, the full scan every month or week, a dated record, and a plan that fits the rules that apply to you. No setup fee, no contract, cancel any month.
Free
Everyone
€0one scan, no account
See where you stand before you decide anything.
- Homepage, four linked pages and your legal pages
- All five checks
- The full report, also as a PDF, kept for seven days
Small
Fewer than ten people
€12per site, per month
The rules that apply to a small shop: the watch every day, the full scan every month.
- Every day: what loads before consent, the cookie window and the AI notice
- The full scan: cookies, business details, reviews and the AI notice
- A dated record: what was added, what was fixed
- Without accessibility: below ten people you are usually not required to
- An email on the day something new appears In development
Starter
Ten or more people
€39per site, per month
All five rules, including accessibility: the watch every day, the full scan every month.
- Every day: what loads before consent, the cookie window and the AI notice
- Up to 15 pages per full scan
- A dated record: what was added, what was fixed
- An email on the day something new appears In development
- Code changes suggested by AI In development
Pro
Larger online shops
€99per site, per month
For those who must be able to show the evidence: the watch every day, the full scan every week.
- Every day: what loads before consent, the cookie window and the AI notice
- Up to 15 pages per full scan
- A dated record: what was added, what was fixed
- An email on the day something new appears In development
- Up to 100 pages per full scan In development
- Code changes suggested by AI In development
Prices exclude VAT. Anything marked ‘in development’ does not exist yet: it is there so you know where the product is heading, and it is not part of what a subscription delivers today.
You cannot check out yet
Accounts and repeat scans are ready, payment is not. Leave your email address and you will be the first to hear, at the price shown here. We will not send you anything else.
Do you build sites for others?
Then this is a service for your clients: keeping up with the law fits into any maintenance contract. Today you scan every client site for free, and your client gets a report that says what needs to be done.
- One account for all your client sites, each with its own record
- The report as plain text, ready for a quote or a ticket
- An agency price, from €15 per site per month In development
- Reports under your own name In development
What people ask first
If the report is clean, am I compliant?
No, and anyone who claims otherwise is selling you something. We measure what can be seen from outside. For accessibility that is 30 to 40 per cent of the criteria; whether a cookie is necessary or a registration number is correct, we cannot see at all. A clean report means a machine found nothing, not that there is nothing.
I work alone. Do I have to do anything?
Yes, but less than you might think. The cookie rules and the mandatory business details apply to every website, including a sole trader’s. Accessibility usually does not: below ten people you are exempt, unless both your turnover and your balance sheet total exceed two million euros. The Small plan is made for exactly this.
Do you fix my website?
No. We show you the change in your own source code that resolves the finding; you or your web developer applies it. We deliberately install nothing on your site and never change your code without you. That is also exactly why we are not an overlay widget.
Is this legal advice?
No. We are a measuring instrument. We can tell you that a cookie was set before consent or that an image has no alt text. We cannot tell you whether a regulator would fine you, or whether your business falls under an exemption. For that, you go to a lawyer.
What does the scanner do to my site?
It reads pages the way a visitor does, from a European address, and clicks nothing. It never logs in, submits no forms, opens no chat window and changes nothing. In your server log it identifies itself as Normwacht.
Which pages are checked?
The free scan covers your homepage and four pages linked from it, and then fetches your terms, contact and privacy pages specifically, because that is where the mandatory details usually are. Starter and Pro cover up to fifteen pages per full scan. With a subscription we also look at your homepage and two other pages every day: what loads before consent, the cookie window and the AI notice.
Can I cancel?
Yes, any month, in your account. Your plan then runs until the end of the month you paid for. There is no setup fee and no minimum term. That is the biggest difference from the agencies that charge hundreds of euros before they start.
One measurement, five rules, a few minutes
Free and without an account. The report stays online for seven days.