Review/Free audit tool (desktop, open source)/No. 7 of 10
EDPB Website Auditing Tool review
An auditor’s desktop tool, free and open source, from the EDPB’s Support Pool of Experts: it documents cookies and trackers before and after consent.
In this article
Published by the European Data Protection Board in January 2024 as a result of its Support Pool of Experts, the Website Auditing Tool is a free, open-source desktop application for Windows, macOS and Linux with its own Chromium browser. The auditor browses the site, accepts or refuses consent and records scenarios, while the tool logs cookies, localStorage, beacons, third-party domains, HTTPS use and unencrypted forms, captures screenshots and exports reports as PDF, DOCX, XLSX or JSON. Compliance judgements are left to the auditor. A command-line alternative is the EDPS Website Evidence Collector.[2]
01In detail
The European Data Protection Board released the Website Auditing Tool on 29 January 2024. An external expert in the EDPB’s Support Pool of Experts developed it, and the EDPB page points out that it is not an EDPB product as such. The source is published under the EUPL on code.europa.eu, and version 3.0.1 appeared on 28 September 2026.
It runs as a desktop application or as a self-hosted web version. The auditor visits the site in the tool’s own Chromium browser, deals with the consent banner and saves scenarios such as “before consent” and “after consent”; recorded user flows can be replayed, and pages can be swept from the sitemap. For each scenario the tool captures cookies (in the browser, in the cache and in requests), localStorage, contacted domains, beacons from the EasyPrivacy and Fanboy lists, HTTPS use and redirection, forms submitted without encryption and, if wanted, a TLS test, plus screenshots. Every item is tagged by the auditor as compliant, not compliant or to be defined, with comments, and reports are produced from templates as PDF, DOCX, XLSX or JSON. Knowledge bases that classify trackers can be edited, imported and exported, though none ships by default.
It reaches no legal conclusions by itself, does not examine privacy-policy content, imprints, e-shop duties or accessibility, and offers no advice on fixes. Its installers are unsigned, and the project recommends downloading them only from code.europa.eu. The interface comes in English, German, Greek, Spanish, French and Italian.
The older EDPS Website Evidence Collector (code.europa.eu/EDPS/website-evidence-collector, version 4.5.0 of 30 September 2026) is a Node.js command-line tool. It crawls a site without interacting and stores evidence as HTML, PDF, YAML, JSON and HAR, which makes it better for automated runs, but it captures only the state before consent and works only in English. Both tools are free.
Few tools document a site’s behaviour before and after consent as well as the EDPB Website Auditing Tool, and it is free.
02What it checks
Of the 7 areas we track, EDPB Website Auditing Tool’s published materials cover 3: cookies in browser storage, consent banner behaviour and third-party trackers. It does not check the privacy policy, the imprint, e-shop consumer information or accessibility.
What it inspects
- Cookie and storage scanYes
- Consent banner behaviourYes
- Tracker and third-party request detectionYes
- Privacy policy reviewNo
- Imprint (legal notice) checkNo
- Consumer-law information (e-commerce)No
- Accessibility checkNo
What you get
- Exportable evidence reportYes
- Fix guidanceNo
- Continuous monitoringNo
- Consent management platform includedNo
- Certificate or sealNo
Languages: EN, DE, EL, ES, FR, IT (interface). Countries covered: Any website; built for EU data protection audits.
03Pricing
The desktop application (Windows, macOS, Linux) and the self-hosted web version are free, with the source code under EUPL 1.2. The EDPS Website Evidence Collector is free as well, also under EUPL 1.2.[1]
Prices as published by the vendor, checked in . Source: edpb.europa.eu/documents/support-pool-of-experts/edpb-website-auditing-tool_en. Prices change; check the vendor’s page before you buy.
04How it scores
EDPB Website Auditing Tool ranks No. 7 of 10 in our 2026 ranking, with an overall score of 6.1 out of 10 (Good). The table shows the score on each criterion and the weight it carries; the method is explained on how we review.
| Criterion | Weight | Score bar | Score |
|---|---|---|---|
| Breadth of legal checks | 25% | 3.6 | |
| Quality of evidence | 20% | 8.0 | |
| Guidance on fixing | 15% | 2.5 | |
| Fit for European law | 15% | 9.0 | |
| Clear prices and value | 15% | 10.0 | |
| Time to first result | 10% | 4.0 | |
| Weighted overall | 100% | 6.1 |
05Pros and cons
What we like
- Free and open source under the EUPL, from the European Data Protection Board’s Support Pool of Experts
- Captures evidence before and after the auditor accepts or refuses consent, with screenshots and user flows that can be replayed
- Records cookies, localStorage, beacons, third-party domains, HTTPS use and forms sent without encryption
- Reports can be edited and exported as PDF, DOCX, XLSX and JSON, and Website Evidence Collector results and HAR files can be imported
- The interface is available in six EU languages
What could be better
- It has to be installed on the desktop from unsigned installers, and a manual audit is time-consuming
- It gives no automatic verdict; deciding what complies is up to the auditor
- No knowledge base of trackers is supplied by default
- Privacy-policy content, the imprint, consumer-law duties and accessibility are not checked, and no advice on fixes is given
06Verdict
Our score: 6.1/10Good
Few tools document a site’s behaviour before and after consent as well as the EDPB Website Auditing Tool, and it is free. It is made for auditors rather than busy site owners, though: it has to be installed, it relies on manual work, it decides nothing by itself and it covers only cookies, trackers and transport security.
Best for: Privacy officers, auditors and agencies who need documented evidence from before and after consent and have time for a manual audit.
07Sources
Every factual statement in this review is taken from the pages below. Where a page did not state something, we say “not published” rather than guess.
- EDPB page (edpb.europa.eu)
- Source code and releases (code.europa.eu)
- EDPS Website Evidence Collector (code.europa.eu)
- EDPS inspection software (edps.europa.eu)
Sources checked in .