GDPR audit | Satsu Docs

Satsu renders your pages the way a first-time visitor sees them — without touching any consent banner — and records what actually happens: which scripts load, which cookies get set, where requests go. That's the standard regulators and warning-letter firms apply, and it routinely contradicts what site owners believe their consent setup does.

Everything below is guidance, not legal advice.

What the categories mean

Trackers — third-party scripts (ad pixels, analytics, social embeds) that process visitor data. Under the GDPR they need informed consent before they load. A tracker firing pre-consent is the classic violation.
Cookies — § 25 TDDDG (the German implementation of the ePrivacy rules, formerly § 25 TTDSG) requires consent for any non-essential access to the visitor's device. The audit lists every cookie set before consent could have been given.
Fonts — webfonts loaded from third-party servers send every visitor's IP address there. The Munich Regional Court (LG München I, 3 O 17493/20) ruled in 2022 that a Google Fonts load from US servers is an actionable violation — and awarded damages. Self-hosting closes the issue mechanically.
Data transfer — since the CJEU's Schrems II judgment (C-311/18), transfers to US servers need a valid legal basis; the successor framework remains under legal challenge. The audit flags requests leaving the EU so you know your exposure.
Transparency — a reachable privacy policy is a GDPR requirement; German-market sites additionally need an imprint (Impressum, § 5 DDG, formerly TMG). Both are trivially machine-detectable, which makes missing ones a favorite target for automated warning letters.

How to read the risk rating

Critical findings are the ones with enforcement history behind them (pre-consent trackers and cookies, external Google Fonts). Fix those first — each finding carries a concrete fix, and most are config-level: self-host the font, gate the script behind consent, add the missing legal page.

Where Satsu itself stands

Satsu's own tracking is cookieless by design — sessions derive from a daily-rotating fingerprint, nothing is stored on the device, so Satsu itself never appears in your consent banner. The full story is in How it's private.