POPIA Website Checker
Enter a web address and this free checker scans the page for the POPIA basics anyone can see from outside: HTTPS, a privacy policy link, consent wording on forms, tracking that starts before consent, an Information Officer and a marketing opt-out. It takes about 20 seconds and shows what to fix in plain English.
Please note: this is an automated look at one public page, not legal advice and not a compliance certificate. POPIA compliance also covers things no scanner can see: how you store, secure and share personal information, your contracts with service providers (operators), staff access, and registering your Information Officer with the Information Regulator.
How it works
The checker opens the page you enter, the same way a browser would, and reads its HTML. If the page links to a privacy policy on the same website, it opens that page too. It then runs up to seven checks (the third only when a privacy policy link is found) and marks each one Pass, Check (worth a closer look), Fix or Info. Here is what each check looks for and why it matters.
1. Page loads over HTTPS
We check that the final address uses https, including after any redirects. Section 19 of POPIA asks you to take reasonable technical measures to protect personal information. Without HTTPS, anything a visitor types into a contact or order form travels unencrypted. An SSL certificate is the basic fix, and many hosts include one free.
2. Link to a privacy policy
We look for a link whose text or address mentions privacy, POPIA, data protection or PAIA. Section 18 says that when you collect personal information you must tell people what you collect, why, who it goes to and how to contact you. A privacy notice linked in the footer and next to each form is the usual way to do that. A cookie policy link on its own is marked Check, because it seldom covers enquiries, orders and newsletters.
3. Privacy policy mentions POPIA
If the privacy link points to your own site, we open it and check that it loads and refers to POPIA. Policies copied from overseas templates often mention only GDPR or United States law, which suggests the policy was not written for how a South African business works. Our guide on writing a website privacy policy covers what to include.
4. Consent wording on forms
For each contact or sign-up form in the page HTML, we look for words like consent, privacy, terms or opt in near the fields. People should know why you want their details at the moment they hand them over (section 18). Search boxes are ignored. Forms that load later through JavaScript, or are embedded from another service, are not visible to this check, so the result shows Info when we find none.
5. Tracking before consent
We look for common tracking and advertising tags that run as soon as the page opens: Google Analytics and Tag Manager, Google Ads, the Meta pixel, Hotjar, Microsoft Clarity, TikTok, LinkedIn and Yandex. These collect personal information such as device identifiers and browsing behaviour. If they run and we find no cookie consent tool, the check shows Fix. If a consent tool or Google Consent Mode is present, it shows Check, because only a test in a real browser can confirm the tags wait for the visitor to accept. Tags that a tag manager adds after the page loads are not visible to us.
6. Information Officer or contact details
We look for the words "Information Officer" on the page and on the privacy policy, then for any email, phone or contact page link. Every business has an Information Officer (by default the owner or head of the business), and section 55 sets out their duties, including dealing with requests from people about their information. They must be registered with the Information Regulator. Naming them in your privacy policy tells people where to send privacy requests.
7. Marketing opt-out explained
We look for wording about unsubscribing, opting out or withdrawing consent, and for newsletter sign-ups. Section 69 limits electronic direct marketing to people who opted in, or to existing customers, and every marketing message must include a way to opt out. If the page invites people to subscribe but never says how to stop, the check shows Check.
What the checker cannot see
A scanner only sees what a public page shows. It cannot see where your form submissions are stored and who can read them, whether your website and email passwords are strong, whether backups are kept safe, whether you have written agreements with your web host, email platform and developer (POPIA calls them operators), how you handle a data breach, or whether your Information Officer is actually registered. It also checks only the one page you enter, so run it on your contact, order and sign-up pages too. Treat the results as a starting list, then work through the full POPIA website compliance guide.
What happens to the address you enter
We fetch only the page you enter and, if it links to one on the same website, its privacy policy page. We do not store the address you check or the results: they appear on your screen and are gone when you close the page. To stop the tool being abused, we keep a one-way hash of your IP address and the time of each check for the hourly limit, never the IP address itself. A Cloudflare Turnstile spam check runs before each scan. If you would like help with the technical side, such as SSL, updates and backups, see our website maintenance plan. You can read how we handle your own information in our privacy policy.
Related services and guides
- Website maintenance: monthly updates, backups and security checks once your site is live
- POPIA website compliance guide: what the Act asks of a small business website
- How to write a website privacy policy: what to include and what to avoid
- Our own privacy policy: how we handle the information you send us
- SSL certificates: HTTPS for every page of your site
Frequently Asked Questions
Is this POPIA checker legal advice?
No. It is an automated look at one public web page and what it links to. It can show obvious gaps, such as a missing privacy policy link or a tracking pixel that loads straight away, but it cannot tell you whether your business complies with POPIA. A pass here is not a compliance certificate. If you handle sensitive information, such as health records, children's details or large customer lists, speak to a lawyer who works with POPIA.
What does POPIA require on a business website?
For a typical small business site the basics are:
- A privacy notice that says what you collect, why, who you share it with and how people can reach you (section 18).
- Reasonable security, starting with HTTPS on every page (section 19).
- Opt-in consent for email and SMS marketing (existing customers are a limited exception), and an opt-out in every message (section 69).
- An Information Officer registered with the Information Regulator (section 55).
- A simple way for people to ask what you hold about them, or to correct or delete it.
Our POPIA website compliance guide covers each point in more detail.
Do I need a cookie banner in South Africa?
POPIA has no rule written specifically about cookies, so there is no law that says "you must show a banner". But analytics and advertising cookies, such as Google Analytics or the Meta pixel, collect personal information like device identifiers and browsing behaviour. That means POPIA's general rules still apply: you need a lawful basis for the processing and you must tell people about it. For tracking that is not needed to run the site, asking for consent before it starts is the safest way to meet both. A banner is the usual way to ask, though a clear notice and settings link can also work for sites with very little tracking.
Why does my site fail the tracking check?
The check fails when a common tracking script (Google Analytics or Tag Manager, the Meta pixel, Hotjar, Clarity, TikTok, LinkedIn and a few others) loads directly from the page HTML and we find no cookie consent tool. It shows "Check" instead when a consent tool or Google Consent Mode with a "denied" default is present, because we cannot tell from outside whether the tags really wait. To test it yourself, open the site in a private browser window, open the browser's developer tools on the Network tab, and see whether tracking requests go out before you click accept.
Who is the Information Officer of my business?
By default, the head of the business: the sole proprietor, the owner, or the CEO of a company. They can delegate the day-to-day work to a Deputy Information Officer, but they stay accountable. POPIA requires the Information Officer to be registered with the Information Regulator, which is done online on the Regulator's eServices portal. Put the Information Officer's name or role and contact details in your privacy policy so people know where to send privacy requests.
Want us to do it for you?
Tell us what you need and we will reply with a clear recommendation and a fixed price. Prefer to chat? WhatsApp or call us.