Neither this page nor the check result is legal advice. We describe technical facts worth knowing; compliance with the GDPR and other rules is for a lawyer to assess.
What the rules require
Storing cookies and similar data (for example in localStorage) on a visitor's device, or reading them from it, is allowed without consent only if they are necessary for the website to work (shopping cart, login, saving the choice in the banner). Everything else, typically analytics and marketing, requires prior consent. This follows from the ePrivacy Directive (in the Czech Republic Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications) and, for personal data, from the GDPR. Consent must be freely given and active, without pre-ticked boxes, and it must be as easy to withdraw as to give.
Why it matters for a small business
The most common problem is not a missing banner but analytics and advertising tags (Google Analytics, Meta Pixel, Google Ads and others) that fire as soon as the page loads, whatever the visitor chooses. Anyone with a browser can spot this, including a supervisory authority or a competitor.
Common cookie banner mistakes
- Tags inserted directly into the website template or a tag manager without being tied to consent.
- The first layer of the banner has no reject button, or it is hidden in the settings.
- Categories are pre-ticked, or the banner merely announces “we use cookies”.
Who the website sends visitor data to
Analytics tags, chat, maps or embedded videos send the visitor's IP address and the page address to other companies. The report lists the third-party services the website loads before consent and the country of each operator.
What WebMeter checks, and what it doesn't
WebMeter loads the homepage once in a real browser, does not click the banner, and records cookies set before consent and requests to known analytics and advertising services. It recognises common consent management tools, checks whether the first layer of the banner offers a way to refuse, and for Google Consent Mode tells whether the pings carry denied or granted consent.
It cannot see what happens after consent is given or on other pages, and it may not recognise services outside its list. If it cannot find the banner or cannot classify its buttons unambiguously, it gives no verdict on refusal. It does not assess your privacy policy, legal basis or purposes of processing.