Open a client site, count what fires before the visitor clicks anything, and see the fine ceiling that country actually applies.
Sanctioned violations present (of four)
—
Cookie lifetime over the 13-month cap
—
months
Days left in the 6-month consent window (negative = overdue)
—
days
Fine ceiling that country applies
—
EUR
Share of that ceiling you are exposed to
—
EUR
Re-audit due
—
date
Keep this audit: export a dated .csv row per client site, and get a browser reminder when the 90-day re-audit falls due.
$60 once · one licence key per person or team seat · A privacy consultant’s per-site assessment runs EUR 688-2,236 for an SMB; a voluntary GDPR audit by a consultancy runs $5,000-$25,000.
Pre-consent tracker count You enter what fires before the visitor clicks anything. Setting trackers before consent is the violation French, Spanish and Italian regulators sanction most often.
13-month cap and 6-month re-ask Measures the longest cookie lifetime you found against the 13-month cap, and the age of the stored consent against the 6-month re-ask window, in days.
Per-country fine ceiling The ceiling changes with the country: France EUR 20,000 (CNIL simplified procedure), Spain EUR 150,000 (LSSI article 39, per infringement), Italy EUR 300,000 (Garante, Ediscom decision, February 2023).
Sources, checked 2026-09-21 CNIL cookie recommendation: cookie lifetime 13 months, consent re-asked every 6 months, simplified-procedure cap EUR 20,000, and 23 cookie sanctions issued since January 2026 at an average of EUR 5,815. Spain: LSSI article 39. Italy: Garante decision on Ediscom, February 2023.
Client CSV (full version) Writes one dated row per audited site — country, trackers before consent, breaches, cookie overrun, exposure — as a .csv you hand to the client.
90-day re-audit reminder (full version) Takes the audit date you type and raises a browser reminder 90 days later, so a site you cleared in March does not drift back by June.