Website Legal Entity Extractor: CIF, VAT ID, Company Name & Compliance Audit

Find the company behind any website: tax ID (Spanish CIF/NIF/NIE or EU VAT number), registered company name and country, taken from the site's own footer, privacy policy and legal notice (aviso legal). In the same run it audits the page's cookie consent behaviour, security headers, tech stack, SEO snapshot and social profiles.

No registry API keys needed. Give it a URL, get one structured record per audited page.

Why use this Actor

• Legal entity + audit in one record. Other Store Actors extract either contact details, a VAT validation, an SEO report or a security scan. This one returns the legal entity and the audit together, so you do not chain four Actors.
• Looks where the data really is. Checks the current page, then the linked privacy policy, then the legal notice, and tells you which one the ID came from (source, sourceUrl).
• Real consent test. Loads the page in separate browser contexts (no interaction, reject all, accept all) and compares which trackers fire before and after consent.
• Pay per audited page. Failed or blocked pages are not billed.

Use cases

• B2B lead enrichment: attach CIF/VAT and legal name to a list of domains.
• KYC / vendor onboarding: pre-fill tax IDs from company websites before checking them in an official registry.
• GDPR and cookie compliance audits: find trackers that load before consent and banners where "reject" does not work.
• Agencies and consultants: audit client or prospect sites (security headers, SEO tags, tech stack) at scale.
• Competitive intelligence: map brands to the legal entities that operate them.

How to use

1. Open the Actor and paste one or more website URLs.
2. Leave Max pages per site at 1 for a fast, cheap run (default).
3. Optional: choose which consent states to test, and set a proxy country close to your audience.
4. Click Start. Results appear in the dataset (Overview table: site, CIF/VAT, company name, score).
5. Export as JSON, CSV or Excel, or call the Actor through the API, Make, Zapier, n8n or MCP.

Input example

{
  "startUrls": [{ "url": "https://www.example.es" }],
  "maxPagesPerSite": 1,
  "consentStates": ["baseline", "reject", "accept"],
  "locales": ["es-ES"],
  "proxyConfiguration": { "useApifyProxy": true, "apifyProxyCountry": "US" }
}

Tip: "consentStates": ["baseline"] runs about 3x faster if you mostly want the legal entity.

Output example

{
  "hostname": "www.example.es",
  "requestUrl": "https://www.example.es",
  "auditedStates": 3,
  "legalEntity": {
    "cif": "B12345678",
    "companyName": "EXAMPLE RETAIL S.L.",
    "country": "ES",
    "source": "legal_notice",
    "sourceUrl": "https://www.example.es/aviso-legal"
  },
  "technologies": ["Google Tag Manager", "Google Analytics", "OneTrust"],
  "trackingIds": 4,
  "preConsentViolations": ["Google Analytics"],
  "complianceScore": { "score": 70, "grade": "B", "breakdown": { "preConsentViolations": -10, "securityHeaders": -20, "rejectFailed": 0 } },
  "darkPatternScore": { "score": 30, "flags": ["reject_button_smaller"] },
  "securityHeaders": { "score": 40, "maxScore": 100, "grade": "C", "findings": [] },
  "socialProfiles": [{ "platform": "instagram", "source": "own_media", "type": "profile_link", "profileId": "example" }]
}

Values above are illustrative. legalEntity fields are null when the site does not publish a tax ID.

Output fields

Field	Description
hostname, requestUrl, siteId	Audited site and page
legalEntity.cif	CIF / NIF / NIE or EU VAT ID, normalized
legalEntity.companyName	Company name found near the tax ID
legalEntity.country	Country code derived from the ID format
legalEntity.source / sourceUrl	current_page, privacy_policy or legal_notice, and its URL
auditedStates	Number of consent states tested
technologies, trackingIds	Detected technologies and number of tracking IDs
preConsentViolations	Analytics/advertising/session-replay technologies active before consent
complianceScore	Score 0-100, grade A-F and penalty breakdown
darkPatternScore	Banner manipulation score and flags (null if no banner)
securityHeaders	Security header score, grade and findings
performance	Core Web Vitals, requests and transfer size (baseline state)
socialProfiles	Social profile links and ad pixel IDs found on the page
deltaMatrix, states	Per-technology and per-state comparison across consent states

Supported tax IDs

Spain (CIF, NIF, NIE) plus VAT formats for FR, DE, IT, PT, NL, PL, BE, AT, IE, SE, DK, FI, RO and GB. Matching is pattern-based: IDs next to labels such as "CIF", "NIF", "VAT" or "identificación fiscal" are preferred; bare matches are lower confidence. Format is checked, but the ID is not validated against VIES or a registry.

Pricing

Pay per event: one result is billed for each audited page that returns data. Your Apify plan tier sets the price.

Plan	Price per 1,000 pages
Free	$35
Bronze	$30
Silver	$25
Gold	$20

Example: 200 sites at 1 page each on the Free plan costs about $7. Set a maximum cost per run in the run options; the Actor stops cleanly when it is reached. Platform usage (compute, proxy) is included in the per-result price.

FAQ

Is it legal? The Actor reads publicly available pages, the same ones a visitor sees, and respects robots.txt by default. Company tax IDs are business data, but you are responsible for complying with the website's terms and with GDPR/local law when you process the results.

Why is legalEntity.cif null? Many sites, especially outside the EU, do not publish a tax ID, or publish it as an image or behind scripts the Actor does not read.

How long does it take? About 1-2 minutes for a page with 3 consent states, less with baseline only. Slow or blocked sites take longer.

Extra datasets (opt-in). By default the Actor writes only to the run's default dataset, so nothing piles up in your storage. Enable saveDetailedDatasets to also get 8 named raw datasets per run (pcs-<runId>-pages, -detections, -network-requests, -storage-items, -tracking-ids, -consent-audit, -social-profiles, -sites). They are not billed as results, but named datasets persist until you delete them.

Consent banners differ by country. Many banners only appear for EU visitors. Use a proxy country in your target market for a faithful consent audit.

How often should I run it? Legal entities rarely change: monthly or on demand. For compliance monitoring, schedule weekly runs.

Integrations. Use the Apify API, Make, Zapier, n8n, webhooks or the Apify MCP server to call it from workflows and AI agents.

Support

Found a site where the tax ID is missed or wrong? Open an issue on the Actor's Issues tab with the URL and we will look at it.