# Website Compliance Scanner - Impressum, Privacy, Cookie Consent (`santamaria-automations/compliance-scanner`) Actor Scan any website for legal compliance markers: Impressum / imprint, privacy policy, cookie-consent banner. Returns a HIGH / MEDIUM / LOW risk flag tuned for DACH GDPR / Abmahnung exposure. Pay-per-result. - **URL**: https://apify.com/santamaria-automations/compliance-scanner.md - **Developed by:** [NanoScrape](https://apify.com/santamaria-automations) (community) - **Categories:** Developer tools, Automation, Lead generation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $3.00 / 1,000 url scanneds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Compliance Scanner **Impressum, privacy policy, cookie consent. One HTTP probe, one risk flag.** Point this actor at any website URL and it returns a structured compliance snapshot: is there an Impressum, is there a privacy policy, is there a cookie-consent banner, which consent vendor is running, and a risk flag tuned for DACH GDPR / Abmahnung exposure. Pure Go HTTP with a real Chrome 124 TLS fingerprint. No browser, no JavaScript rendering. Fast enough to scan a lead list of thousands in minutes. ### Features - **Impressum detection.** Anchor-text scan on the homepage plus targeted probes of `/impressum`, `/legal-notice`, `/imprint`, `/mentions-legales`, `/note-legali`, `/aviso-legal`, `/juridische-informatie`. - **Privacy policy detection.** Same shape: anchor-text scan plus path probes for `/datenschutz`, `/privacy`, `/privacy-policy`, `/politique-confidentialite`, and equivalents. - **Cookie consent detection.** Identifies Cookiebot, Usercentrics, OneTrust, Iubenda, TrustArc, Consentmanager, Complianz, Borlabs, Klaro, Termly, and Quantcast. Falls back to a generic banner marker when the vendor cannot be identified. - **Language detection.** Reads `` first, falls back to a German stopword count for sites without a language attribute. Emits a two-letter code. - **Risk flag.** HIGH when a German-language site is missing an Impressum (Abmahnung exposure). MEDIUM on softer gaps. LOW when all three markers are present. UNKNOWN when the homepage cannot be fetched. - **Tracking detection.** Flags the presence of Google Analytics, GTM, Meta Pixel, Hotjar, LinkedIn Insight, TikTok Pixel, Matomo, and others so you can spot "tracking without consent" cases. - **Fast.** 5 URLs in parallel by default. Runs at 256 MB RAM with no browser overhead. ### DACH use case: Abmahnung avoidance German-language sites without a valid Impressum are directly actionable under Section 5 TMG and Section 55 RStV. Lawyers issue Abmahnung letters for a few hundred euros a pop, and the penalty stack grows fast on repeat offenders. Same story for missing privacy policies and tracking cookies set before consent. This scanner is the fastest way to build a prioritized list of local businesses that need help. Feed it a Google Maps export or a lead scrape, filter for `risk_flag = "HIGH"`, and you have a warm outreach list for a legal-tech agency, GDPR consulting practice, or marketing shop selling Impressum-Generator plugins. ### When to use it - **Legal-tech and GDPR consulting.** Bulk-prospect leads by compliance gap. - **Marketing agencies.** Filter your web-design lead list for sites that visibly need work. - **Sales enablement.** Add a compliance signal to your CRM enrichment pipeline. - **Compliance monitoring.** Snapshot your own domain portfolio nightly and catch regressions. - **Vendor migration research.** Discover which consent tool a competitor or partner runs. ### Input | Parameter | Type | Default | Description | |---|---|---|---| | `urls` | array | **required** | Website homepage URLs to scan. Bare domains accepted. | | `companies` | array | `[]` | Alternative paired input: `[{"company_id":"...","website_url":"..."}]` for CRM join-back. | | `probeTimeoutMs` | integer | `5000` | HTTP timeout per fetch. Cap 15000. | | `respectRobotsTxt` | boolean | `true` | Honor the site's robots.txt on path probes. | | `concurrency` | integer | `5` | Number of URLs scanned in parallel. | | `proxyConfiguration` | object | Apify datacenter | Optional proxy. Datacenter is fine for compliance probes. | ### Output shape One row per input URL: ```json { "url": "https://example.de/", "final_url": "https://www.example.de/", "status_code": 200, "site_language": "de", "has_impressum": true, "impressum_url": "https://www.example.de/impressum", "has_privacy_policy": true, "privacy_policy_url": "https://www.example.de/datenschutz", "has_cookie_consent": true, "consent_tool": "usercentrics", "sets_tracking_cookies": true, "risk_flag": "LOW", "risk_reasons": [], "probed_at": "2026-07-21T09:00:00Z" } ```` When the probe fails: ```json { "url": "https://broken.example/", "status_code": 0, "risk_flag": "UNKNOWN", "risk_reasons": ["probe_failed"], "probed_at": "2026-07-21T09:00:00Z", "error": "request timed out" } ``` #### Risk flag semantics | flag | Meaning | |---|---| | `HIGH` | Missing Impressum on a German-language site. Directly actionable under Abmahnung practice. | | `MEDIUM` | Any other single compliance gap (missing privacy policy, tracking without consent, missing Impressum on non-DE site). | | `LOW` | Impressum, privacy policy, and cookie consent all present. | | `UNKNOWN` | Homepage could not be fetched. | Risk reasons are stable machine-readable strings you can filter on: - `missing_impressum_de_site` - `missing_impressum` - `missing_privacy_policy` - `tracking_without_consent` - `probe_failed` ### Pricing - **$0.001** per run start - **$0.003** per URL scanned Failed probes are billed too. They still consumed a run slot and returned a UNKNOWN row so you can retry the URL later. **1000 URLs = $3.00.** ### Related Actors - [Broken Link Checker](https://apify.com/santamaria-automations/broken-link-checker). Find 404s, redirects, SSL errors, and dead outbound links. - [SSL Certificate Inspector](https://apify.com/santamaria-automations/ssl-certificate-inspector). Inspect TLS certificates and TLS versions for any host. - [Website Tech Stack Detector](https://apify.com/santamaria-automations/website-tech-detector). Identify the CMS, frameworks, analytics, and hosting behind any site. - [SEO Metadata Extractor](https://apify.com/santamaria-automations/seo-metadata-extractor). Pull titles, meta tags, Open Graph, Twitter Cards, and JSON-LD schema. ### Issues & Feedback Found a bug or a compliance signal we should detect? Please open an issue on the actor page. # Actor input Schema ## `urls` (type: `array`): List of website homepage URLs to probe. You can provide bare domains (example.com) or full URLs (https://www.example.com/). Each URL is scanned independently and produces one result row. ## `companies` (type: `array`): Alternative to urls. Pass an array of {company\_id, website\_url} pairs when you want the company\_id echoed back on the output row for CRM join-back. Both urls and companies may be supplied together. ## `probeTimeoutMs` (type: `integer`): HTTP timeout applied to every fetch (homepage + path probes). Sites with slow origin servers may need a higher value. ## `respectRobotsTxt` (type: `boolean`): Honor the site's robots.txt when probing legal page paths. Homepage is always fetched. Disable only when auditing a site you own or operate. ## `concurrency` (type: `integer`): Number of URLs probed in parallel. Compliance probes are lightweight, but the default of 5 keeps load on each target site polite. ## `proxyConfiguration` (type: `object`): Optional Apify proxy settings. Datacenter proxy is sufficient for compliance probes. Enable if your run is hitting rate limits. ## `preFetchedByURL` (type: `object`): Map of URL -> pre-fetched homepage result. When set, this actor uses the provided HTML for its initial homepage step (CMP detection, cookie consent) instead of fetching. Path probes for /impressum, /datenschutz etc. still fetch normally. Used by the google-maps-scraper orchestrator to consolidate homepage fetches. Direct users should leave this blank. ## Actor input object example ```json { "urls": [ "https://www.deutschebank.de/" ], "companies": [], "probeTimeoutMs": 5000, "respectRobotsTxt": true, "concurrency": 5, "proxyConfiguration": { "useApifyProxy": true, "apifyProxyGroups": [ "BUYPROXIES94952" ] } } ``` # Actor output Schema ## `results` (type: `string`): Dataset with one row per URL. Fields: impressum / privacy / cookie-consent presence, consent tool name, site language, and risk flag. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "urls": [ "https://www.deutschebank.de/" ], "companies": [] }; // Run the Actor and wait for it to finish const run = await client.actor("santamaria-automations/compliance-scanner").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "urls": ["https://www.deutschebank.de/"], "companies": [], } # Run the Actor and wait for it to finish run = client.actor("santamaria-automations/compliance-scanner").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "urls": [ "https://www.deutschebank.de/" ], "companies": [] }' | apify call santamaria-automations/compliance-scanner --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=santamaria-automations/compliance-scanner", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Website Compliance Scanner - Impressum, Privacy, Cookie Consent", "description": "Scan any website for legal compliance markers: Impressum / imprint, privacy policy, cookie-consent banner. Returns a HIGH / MEDIUM / LOW risk flag tuned for DACH GDPR / Abmahnung exposure. Pay-per-result.", "version": "1.0", "x-build-id": "HQ6PGdNGoU12u4a3i" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/santamaria-automations~compliance-scanner/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-santamaria-automations-compliance-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/santamaria-automations~compliance-scanner/runs": { "post": { "operationId": "runs-sync-santamaria-automations-compliance-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/santamaria-automations~compliance-scanner/run-sync": { "post": { "operationId": "run-sync-santamaria-automations-compliance-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "urls" ], "properties": { "urls": { "title": "Website URLs", "type": "array", "description": "List of website homepage URLs to probe. You can provide bare domains (example.com) or full URLs (https://www.example.com/). Each URL is scanned independently and produces one result row.", "items": { "type": "string" } }, "companies": { "title": "Companies (paired input)", "type": "array", "description": "Alternative to urls. Pass an array of {company_id, website_url} pairs when you want the company_id echoed back on the output row for CRM join-back. Both urls and companies may be supplied together." }, "probeTimeoutMs": { "title": "Probe Timeout (ms)", "minimum": 1000, "maximum": 15000, "type": "integer", "description": "HTTP timeout applied to every fetch (homepage + path probes). Sites with slow origin servers may need a higher value.", "default": 5000 }, "respectRobotsTxt": { "title": "Respect robots.txt", "type": "boolean", "description": "Honor the site's robots.txt when probing legal page paths. Homepage is always fetched. Disable only when auditing a site you own or operate.", "default": true }, "concurrency": { "title": "Concurrency", "minimum": 1, "maximum": 20, "type": "integer", "description": "Number of URLs probed in parallel. Compliance probes are lightweight, but the default of 5 keeps load on each target site polite.", "default": 5 }, "proxyConfiguration": { "title": "Proxy Configuration", "type": "object", "description": "Optional Apify proxy settings. Datacenter proxy is sufficient for compliance probes. Enable if your run is hitting rate limits.", "default": { "useApifyProxy": true, "apifyProxyGroups": [ "BUYPROXIES94952" ] } }, "preFetchedByURL": { "title": "Pre-fetched HTML by URL (internal, orchestrator use only)", "type": "object", "description": "Map of URL -> pre-fetched homepage result. When set, this actor uses the provided HTML for its initial homepage step (CMP detection, cookie consent) instead of fetching. Path probes for /impressum, /datenschutz etc. still fetch normally. Used by the google-maps-scraper orchestrator to consolidate homepage fetches. Direct users should leave this blank." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```