External Regulator Scan
Warning-letter crawlers record googletagmanager.com and facebook.net on first paint. The visitor IP is already in a US processor log. Storage or access of information on the terminal equipment lacks a § 25 TDDDG basis.
Local CLI. GDPR, ePrivacy, Schrems II.
Audit your website before European regulators do.
KlarAudit launches headless Chromium on your machine, records first-paint requests before any consent click, and scores the page against TTDSG / TDDDG § 25, GDPR Art. 6 and Art. 83, LG München 3 O 17493/20, and Schrems II. No cloud account. No telemetry. Exit code 1 on CRITICAL or HIGH findings.
npx klaraudit scan https://example.com Sample trace
What the CLI prints on a failing first paint
KlarAudit does not click Accept. It watches the idle load, resolves remote IPs with a local GeoIP database, then scores the page. The trace below matches a representative NON_COMPLIANT run.
klaraudit scan https://shop.example.de --ci
NON_COMPLIANT
$ Scanning https://shop.example.de timeout=15000ms
intercept network (pre-consent, no click)
targets: cookies, scripts, fonts, banner DOM, /impressum, /datenschutz
FAIL googletagmanager.com/gtag/js tracker before consent
FAIL fonts.googleapis.com 142.250.185.196 (US) unannotated transfer
FAIL first-layer Reject / Ablehnen missing
OK /impressum 200 /datenschutz 200
Score 45 / 100
Status NON_COMPLIANT (threshold < 60)
| Severity | Category | Finding | Delta | Remediation |
|---|---|---|---|---|
| CRITICAL | TRACKING_CONSENT | GTM fired before consent (googletagmanager.com) | -30 | Block GTM/gtag until explicit opt-in. |
| HIGH | CROSS_BORDER_TRANSFER | fonts.googleapis.com resolved to US IP 142.250.185.196 | -15 | Self-host fonts. Do not load Google Fonts on first paint. |
| MEDIUM | BANNER_DARK_PATTERN | No equal-prominence Reject / Ablehnen on first layer | -10 | Place Ablehnen beside Accept at the same visual weight. |
CI gate: FAIL status is NON_COMPLIANT; CRITICAL or HIGH violations present.
exit 1
Inspection Manifest
First-paint controls, in inspection order
Sequential catalog of the checks a German or EU automated scan can trigger before a visitor interacts. Each row pairs the external regulator view with the local CLI finding.
- Document
- KLAR-IMF-01
- Scope
- Scope: pre-consent first paint
- Engine
- Engine: Playwright Chromium (local)
- 01
Pre-Consent Network Interception
CRITICAL / TRACKING_CONSENT
Catches GTM, Meta Pixel, and other known trackers that fire before the user clicks consent. The runner hooks page requests before navigation and never clicks Accept.
REF: TTDSG / TDDDG § 25, GDPR Art. 6
KlarAudit CLI Output
TRACKING_CONSENT CRITICAL -30 GTM fired before consent (googletagmanager.com)
- 02
Dynamic Cross-Border IP Leaks
HIGH / CROSS_BORDER_TRANSFER
Detects US asset calls such as Google Fonts and unverified CDN hops. Remote IPs are classified with an offline GeoIP database. The scanner does not call a cloud lookup API.
REF: LG München 3 O 17493/20, Schrems II
External Regulator Scan
LG München I held that loading Google Fonts from US servers without consent unlawfully transmits the visitor IP. Schrems II invalidated Privacy Shield. Unannotated US transfers remain an Art. 83 GDPR fine risk.
KlarAudit CLI Output
CROSS_BORDER_TRANSFER HIGH -15 fonts.googleapis.com -> 142.250.185.196 (US) No DPF/SCC annotation on the request path
- 03
Consent Layer & Dark Patterns
MEDIUM / BANNER_DARK_PATTERN
Validates the first-layer DOM for a reject action with equal prominence to accept. Settings-only paths and visually weaker refusal controls fail this check.
REF: EDPB Guidelines 03/2022
External Regulator Scan
EDPB Guidelines 03/2022 require a genuine choice. A prominent Accept next to a grey settings link is treated as a dark pattern. Equal-prominence Ablehnen is the German baseline.
KlarAudit CLI Output
BANNER_DARK_PATTERN MEDIUM -10 No equal-prominence Reject / Ablehnen on first layer
- 04
Local Pipeline Gate & Offline Auditing
GATE / CI_GATE
Runs entirely inside your runner or CLI. Zero cloud dependencies. Deterministic exit codes for CI/CD. Network capture, DOM heuristics, and GeoIP stay on the machine that launched the scan.
REF: CI exit contract, GDPR Art. 32
External Regulator Scan
External scanners do not wait for a SaaS dashboard. They score the site as shipped. A merge that introduces a US font or a pre-consent pixel is visible on the next crawl.
KlarAudit CLI Output
--ci exit 1 status NON_COMPLIANT, or any CRITICAL/HIGH finding stdout JSON, no outbound telemetry
Scoring
Heuristic deductions and status bands
Base score 100. Deductions apply per incident, then the result is floored at 0. CRITICAL deductions are capped at -60. These are technical heuristics, not a legal opinion.
| Category | Severity | Deduction | Criteria |
|---|---|---|---|
| Tracking Consent | CRITICAL | -30 / incident (CRITICAL total capped at -60) | GTM, Google Analytics, Meta Pixel, DoubleClick, Hotjar, TikTok, Clarity, or non-essential tracking cookies fire during the interaction-free load. A missing first-layer banner while third-party activity is present is also CRITICAL. |
| Cross-Border Transfer | HIGH | -15 / unique non-EU asset | Fonts, scripts, or stylesheets resolved outside the EU/EEA via local geoip-lite. Dynamic Google Fonts (fonts.googleapis.com / fonts.gstatic.com) are always flagged. An IP to Google without consent is treated as a Schrems II leak (LG München 3 O 17493/20). |
| Banner Dark Patterns | MEDIUM | -10 / incident | A consent UI exists, but Reject / Ablehnen (or equivalent) is missing or weaker than Accept on the first layer. Settings-only or grey-link refusal paths fail EDPB Guidelines 03/2022. |
| Mandatory Pages | LOW | -5 / missing page | /impressum or /imprint and /datenschutz or /privacy must return HTTP 200. Common German and EU commercial disclosure requirement. |
>= 85
COMPLIANT
Heuristic bar cleared for first paint.
60-84
WARNING
Issues remain. Not a clean client handover.
< 60
NON_COMPLIANT
--ci exits 1. Fix before launch.
License
Open Source CLI and Agency License
The scanner is free to run locally. The Agency License adds branded A4 PDF reports and client handover rights. Checkout via Lemon Squeezy.
| Parameter | Open Source CLI Free | Agency License $79 one-time |
|---|---|---|
| Price | $0 | $79 USD, one-time |
| License | MIT | Agency license (client handover) |
| Runtime | Local npx or Docker | Local npx or Docker |
| Output | Terminal, JSON | Terminal, JSON, branded A4 PDF |
| CI/CD gate | --ci exit codes | --ci exit codes |
| Cloud dependency | None | None |
| Client handover | No branded PDF rights | Branded A4 PDF, handover rights |
PDF branding and client handover require the Agency License. Scan execution itself stays on your machine in both tiers.