Over 80% of sites scanned on Juro had at least one pre-consent tracker. Each finding cites the exact provision with no vague recommendations. 85% of websites globally collect data before any user interaction (PreConsent.io, 10,000+ sites, 2026).
Built for the people who get asked "are we compliant?"
The difference shows up in evidence quality, not feature lists
OneTrust tells you a cookie exists. Juro tells you it fired 2.3 seconds before consent, violating GDPR Art. 6(1)(a). With a signed artifact your DPO can hand to a regulator.
| Juro | Legacy compliance suites | Free cookie scanners | |
|---|---|---|---|
| Architecture | Non-custodial, agent-based | Your data uploaded to their cloud | Surface cookies only |
| Frameworks | DPDP + GDPR + DORA | One framework at a time | GDPR only |
| Evidence | Signed, deterministic artifacts | Screenshot-based reports | No evidence output |
| Surface scan | Free, no account required | Sales demo required | Free, email-gated |
| India / DPDP | Purpose-built from day one | GDPR module adapted for DPDP | Not covered |
Things people ask before trusting a scan tool
How do I know the scan is accurate?
The scanner doesn't guess. It intercepts actual network requests as a real browser loads your page. If a script fires before the consent interaction, the scanner records the URL, the timestamp, and the exact millisecond offset. That's a deterministic fact, not a heuristic. Every finding is bundled into a signed artifact: the same inputs always produce the same SHA-256 hash, so any auditor can independently verify that the output hasn't been altered after the fact.
What is DPDP compliance and when does it start?
DPDP (Digital Personal Data Protection Act 2023) is India's data protection law. The DPDP Rules 2025 were notified on November 13, 2025, and enforcement is phased. Full compliance obligations become enforceable on May 13, 2027. It requires websites to obtain explicit user consent before collecting personal data, provide clear privacy notices in plain language, and implement data security measures. Fines reach ₹250 crore per violation. Under Section 8(1), the data fiduciary remains responsible for compliance, including for processing carried out by a data processor on its behalf, irrespective of any agreement to the contrary.
How does the compliance scanner work?
A headless Chromium browser loads your URL, intercepts every network request, and records which scripts fire before the consent interaction. Rules then match the observed behaviour against DPDP sections, GDPR articles, and DORA provisions. The result is a signed artifact: not a screenshot, not a checklist. It maps each violation to the specific provision and includes remediation steps.
Is the website compliance scanner really free?
Yes. The surface scanner is completely free with no account required. It checks website-layer compliance including consent flows, tracker timing, and privacy notice presence. For deeper infrastructure assessments (backend APIs, PII in logs, unencrypted data columns), contact us for a technical readiness assessment.
What is the difference between GDPR, DORA, and DPDP?
GDPR (General Data Protection Regulation) is the EU's data protection law covering all organisations processing EU residents' data. DORA (Digital Operational Resilience Act) is the EU's financial sector cybersecurity regulation that took effect January 17, 2025, covering ICT risk management, incident reporting, and third-party oversight. DPDP (Digital Personal Data Protection Act) is India's data protection law covering processing of digital personal data of Indian residents. The scanner checks for all three simultaneously.
What does the scanner detect on my website?
The scanner detects analytics and advertising scripts that fire before user consent, consent banners without an equivalent "Reject All" button, missing or incomplete privacy notices, forms that collect personal data without a lawful basis, and third-party trackers that transmit data without consent. Each finding cites the exact regulatory provision it violates.
How is Juro different from OneTrust, Vanta, or cookie scanners?
Juro is non-custodial: your data never leaves your perimeter. Legacy compliance suites like OneTrust and Vanta require you to upload data to their cloud. Free cookie scanners only check surface cookies and do not map findings to regulatory provisions. Juro produces signed, deterministic artifacts that can be independently verified, covering DPDP, GDPR, and DORA in a single scan.
Does Juro store or process my website data?
The scanner runs server-side against your public URL. Your page content, cookies, and user data are never written to disk. Only the analysis output is retained, for 90 days, to power the scan cache. For infrastructure assessments, the agent runs inside your VPC with a read-only IAM role and produces signed findings locally. Nothing is uploaded to our cloud.