I published the full story here:

https://securespells.com/blog/se...

Short version:

The short answer: GDPR follows the person, not the company

GDPR's territorial scope (Article 3(2)) depends on where your users are and whether you target or monitor them not where your company is incorporated. So if EU visitors hit your site and you run Google Analytics, Meta Pixel, or any behavioural tool, you're likely in scope.

Why do we need another website scanner?

I got asked this at sTARTUp Day event in Tartu, Estonia, and honestly, it s a fair question.

There are already a lot of tools that scan websites for Privacy and GDPR.

When building SecureSpells, I made a very intentional early decision: I didn t want to store any readable personal data.

No names. No plain emails. No passwords. Etc...

I've been auditing different websites lately, and I'm finding that most of "compliant" banners still fire scripts before the user clicks Accept.

We get the legal requirements ("Prior Consent"), but the implementation seems impossible to maintain without breaking the UX.