Skip to content

Local CLI. GDPR, ePrivacy, Schrems II.

Audit your website before European regulators do.

KlarAudit launches headless Chromium on your machine, records first-paint requests before any consent click, and scores the page against TTDSG / TDDDG § 25, GDPR Art. 6 and Art. 83, LG München 3 O 17493/20, and Schrems II. No cloud account. No telemetry. Exit code 1 on CRITICAL or HIGH findings.

npx klaraudit scan https://example.com

CI/CD gate Source on GitHub

Sample trace

What the CLI prints on a failing first paint

KlarAudit does not click Accept. It watches the idle load, resolves remote IPs with a local GeoIP database, then scores the page with actionable evidence (URL, IP, GeoIP, fix). The trace below matches a representative NON_COMPLIANT run.

klaraudit scan https://shop.example.de --ci

$ Scanning https://shop.example.de timeout=15000ms

intercept network (pre-consent, no click)

targets: cookies, scripts, fonts, banner DOM, /impressum, /datenschutz

FAIL Google Tag Manager googletagmanager.com before consent

FAIL Google Fonts fonts.googleapis.com 142.250.185.196 · GeoIP US

FAIL Reject / Ablehnen missing while hosts: googletagmanager.com

OK /impressum 200 /datenschutz 200

Score 45 / 100

Status NON_COMPLIANT (threshold < 60)

Severity Category Finding Delta Remediation
CRITICAL TRACKING_CONSENT Google Tag Manager (googletagmanager.com) loaded on first paint before any consent click -30 Load GTM only after opt-in (Consent Mode / CMP gate).
HIGH CROSS_BORDER_TRANSFER Google Fonts from fonts.googleapis.com resolved to IP 142.250.185.196 in US — visitor IP sent to Google before consent -15 Self-host fonts or load Google Fonts only after consent.
MEDIUM BANNER_DARK_PATTERN Consent UI found, but no equal-prominence Reject / Ablehnen while third-party hosts are active -10 Place Ablehnen beside Accept at the same visual weight.

CI gate: FAIL status is NON_COMPLIANT; CRITICAL or HIGH violations present.

exit 1

Inspection Manifest

First-paint controls, in inspection order

Sequential catalog of the checks a German or EU automated scan can trigger before a visitor interacts. Each row pairs the external regulator view with the local CLI finding.

Document
KLAR-IMF-01
Scope
Scope: pre-consent first paint
Engine
Engine: Playwright Chromium (local)
  1. 01

    Pre-Consent Network Interception

    CRITICAL / TRACKING_CONSENT

    Catches GTM, Meta Pixel, and other known trackers that fire before the user clicks consent. The runner hooks page requests before navigation and never clicks Accept.

    REF: TTDSG / TDDDG § 25, GDPR Art. 6

    Warning-letter crawlers record googletagmanager.com and facebook.net on first paint. The visitor IP is already in a US processor log. Storage or access of information on the terminal equipment lacks a § 25 TDDDG basis.

    TRACKING_CONSENT  CRITICAL  -30
Google Tag Manager (googletagmanager.com)
loaded on first paint before consent
evidence: gtag/js URL · GeoIP US
  2. 02

    Dynamic Cross-Border IP Leaks

    HIGH / CROSS_BORDER_TRANSFER

    Detects Google Fonts, other non-EU third-party hosts, and first-party CDN/hosting edges (for example a Vercel edge outside the EU). Remote IPs are classified with an offline GeoIP database. The scanner does not call a cloud lookup API.

    REF: LG München 3 O 17493/20, Schrems II

    LG München I held that loading Google Fonts from US servers without consent unlawfully transmits the visitor IP. Schrems II invalidated Privacy Shield. Unannotated US transfers remain an Art. 83 GDPR fine risk.

    CROSS_BORDER_TRANSFER  HIGH  -15
Google Fonts fonts.googleapis.com
IP 142.250.185.196 · GeoIP US
Self-host fonts or delay until consent
  3. 03

    Consent Layer & Dark Patterns

    MEDIUM / BANNER_DARK_PATTERN

    Validates the first-layer DOM for a reject action with equal prominence to accept. When it fails, the report lists the third-party hosts or cookies that made a banner required. Settings-only paths and visually weaker refusal controls fail this check.

    REF: EDPB Guidelines 03/2022

    EDPB Guidelines 03/2022 require a genuine choice. A prominent Accept next to a grey settings link is treated as a dark pattern. Equal-prominence Ablehnen is the German baseline.

    BANNER_DARK_PATTERN  MEDIUM  -10
No equal-prominence Reject / Ablehnen
while hosts: googletagmanager.com
  4. 04

    Local Pipeline Gate & Offline Auditing

    GATE / CI_GATE

    Runs entirely inside your runner or CLI. Zero cloud dependencies. Deterministic exit codes for CI/CD. Network capture, DOM heuristics, and GeoIP stay on the machine that launched the scan. Use --format json for machine-readable output.

    REF: CI exit contract, GDPR Art. 32

    External scanners do not wait for a SaaS dashboard. They score the site as shipped. A merge that introduces a US font or a pre-consent pixel is visible on the next crawl.

    --ci  exit 1
status NON_COMPLIANT, or any CRITICAL/HIGH finding
npx klaraudit scan URL --format json

Scoring

Heuristic deductions and status bands

Base score 100. Deductions apply per incident, then the result is floored at 0. CRITICAL deductions are capped at -60. These are technical heuristics, not a legal opinion.

Tracking Consent CRITICAL -30 / incident (CRITICAL total capped at -60) Named vendors (GTM, Google Analytics, Meta Pixel, DoubleClick, Hotjar, TikTok, Clarity) or tracking cookies fire on first paint. Findings include the request URL and a concrete fix. A missing first-layer banner while third-party activity is present is also CRITICAL.
Cross-Border Transfer HIGH -15 / unique non-EU asset Requests resolved outside the EU/EEA via local geoip-lite. Distinguishes Google Fonts, third-party hosts, and first-party CDN/hosting edges. Evidence includes IP and country when available.
Banner Dark Patterns MEDIUM -10 / incident A consent UI exists, but Reject / Ablehnen (or equivalent) is missing or weaker than Accept on the first layer. The report lists the third-party hosts/cookies that triggered the check.
Mandatory Pages LOW -5 / missing page /impressum or /imprint and /datenschutz or /privacy must return HTTP 200. Findings include the probed URL and status.

>= 85

COMPLIANT

Heuristic bar cleared for first paint.

60-84

WARNING

Issues remain. Review before treating the page as safe.

< 60

NON_COMPLIANT

--ci exits 1. Fix before launch.

License

Free and open source under MIT

KlarAudit is a portfolio project by Shoebill Software. The full CLI is free: local scans, CI gates, JSON, and A4 PDF reports. No account, no telemetry, no paid tier.

  • MIT license — use, modify, and redistribute
  • Terminal, JSON, and A4 PDF output
  • Local npx or Docker with bundled Chromium
  • Deterministic --ci exit codes for merge gates
View source on GitHub npm package

Run locally 

npx klaraudit scan https://example.com
npx klaraudit scan https://example.com --format json
docker run --rm --init --ipc=host ghcr.io/shoebill-software/klaraudit scan https://example.com

Findings are technical heuristics, not legal advice. For npx, install Chromium once with: npx playwright-core@1.63.0 install chromium — or use the Docker image, which already includes the browser.