How it works

What happens on a check

A check takes about a minute. The scanner runs on a server in Germany and starts a fresh browser with no stored data for every check.

1. The scanner starts the browser and reads which country it connects from.
2. It opens the website’s start page and scrolls all the way down.
3. It waits 6 seconds. Everything loaded by then counts as “before the click”. That is roughly what your browser loads on a first visit before you click anything.
4. It looks for a consent banner and clicks exactly once on the button that agrees to everything, usually “Accept all”. If it finds none, it is unclear where to click, or the click does nothing, the check ends here.
5. If the click worked, it waits two and a half seconds, scrolls once more and waits another 6 seconds. Everything loaded up to about 11 seconds after the click counts as “after the click”. So “after the click” also includes everything loaded before it.
6. It closes the browser. The domains the page contacted are matched to the companies in the list below.

Apart from that one click it touches nothing: it does not sign in, submit forms or solve captchas. It does not pretend to be a person either.

What the result says and what it does not

• A snapshot. It is a single visit. An hour later the picture can look different.
• The scanner is a bot. It comes from a data-centre address in Germany and does not disguise itself. Some sites turn it away, and others treat it differently from a person. If a site turns it away there is no result, and the page says so.
• Only what the browser sees directly. What the website’s server passes on in the background stays invisible. So do services that run through the website’s own domain. “No outside domain observed” therefore does not mean that no data flows.
• A company’s seat is not its server. The arcs on the globe end at the company’s seat. That does not show where its servers are or where the data ends up, and not whether a transfer is lawful either.
• Unmatched domains. Domains that are not matched to a company in the list are counted as “unmatched”. They may include other domains of the website itself.
• “After the click” does not mean “because of the click”. It is one session. Some things load after the click only because time has passed or the page was scrolled.
• Ads change. Every page view runs a new ad auction, so the companies that show up vary.
• Start page only. Other pages can look different, for example articles with videos or a shopping basket.

Corrections and exclusions

If something in the list below or a result is wrong, write to mail@lukasfreitag.de. Name the domain and what is off. A link to a source helps.

If you run a website and do not want it checked, write to mail@lukasfreitag.de as well. The website is then excluded from checks. Anyone who enters it afterwards gets a note instead of a result, saying it is excluded at its operator’s request.

A result is kept for 6 hours so the same site is not checked over and over. Only hostnames, counts, the outcome of the click and the scan environment are stored, with no page content, no paths and no cookie values. To have a result deleted sooner, write to the same address.

Which companies the scanner knows

A domain is matched to a company only when a source ties them together, for example the company’s privacy page or the service’s documentation. The seat has a source of its own. Domains without a source are not in the list and count as “unmatched”.

Mapping as of 25 October 2026

This is a technical measurement, not legal advice.