Check your site for three common breaches of Law 195/2024 on personal data protection

Verific opens your site the way an ordinary visitor would and checks the three things sites trip over most often: the cookie banner, Google Analytics, and the privacy page. This isn't a full compliance check — only the most common and most visible items. Free, in 15–30 seconds, no sign-up.

what the check does
  1. 01siteOpening your site
  2. 02requestsWatching network requests before consent
  3. 03bannerLooking for the cookie banner and consent tool
  4. 04declineClicking “Decline” and checking whether tracking stops
  5. 05privacyOpening the privacy page and checking the required sections

Preliminary technical scan, not legal advice.

By submitting an address for a check, you agree to the Terms of use and Privacy policy.

What Verific checks

Three technical signs by which a regulator, or an unhappy visitor, first realises that a site hasn’t put its personal-data handling in order.

Cookie banner and consent

ruleUntil the visitor has made a choice, the site must not start analytics, ad pixels, or other non-essential scripts. The “Decline” button has to actually switch them off.

violationThere is no banner. Analytics loads the moment you arrive. After “Decline”, trackers keep running.

Google Analytics 4

ruleGA4 is allowed, but full data may only be sent after consent. Consent Mode is fine: before consent, an anonymised signal is sent with no cookie.

violationGA4 sends full data, with a visitor identifier, before the person has clicked “Accept”.

Privacy page

ruleThe policy must be reachable and contain seven required sections: who the controller is, the purposes and legal bases for processing, retention periods, data subject rights, a contact for data matters, and transfers of data outside the country.

violationThere is no page. Or there is one, but some of the required sections are missing from it.

Types of cookies

A cookie is a small piece of data a website stores in the visitor's browser. Some fall outside the scope of the law entirely; others require explicit consent — the difference is what they're for.

Necessary (functional) cookies — interface language, cart contents, sign-in, bot protection. Without them the site wouldn't work correctly, so the law allows installing them without a consent banner.

Analytics and advertising cookies — Google Analytics, ad pixels (Meta, TikTok, Google Ads), heatmaps (Hotjar) and similar services. They assign the visitor an identifier and recognise them on later visits — that is, they process personal data. That requires a lawful basis, and in practice the only one that applies is consent: running them before the visitor has consented is a violation.

What happens if you don't comply

Law 195/2024 was adopted on 25 July 2024 and entered into force on 23 August 2026 — it replaces the earlier Law 133/2011 and brings the EU GDPR approach into Moldovan law.

The law sets two tiers of fines: up to 1,000,000 lei (or up to 1% of the company's annual turnover, whichever is greater) for less serious violations, and up to 2,000,000 lei (or up to 2% of turnover) for serious ones — including breaches of processing principles, consent requirements, data subject rights, and cross-border transfer rules. Tracking a visitor without consent falls into exactly this category.

Fines are phased in: 10% of the calculated amount in the first year after the law takes effect, 40% in the second year, and the full amount from the third year on. Right now is the first year — the moment to get your site in order while penalties are still reduced.

Compliance is checked and fines are imposed by the National Center for Personal Data Protection (CNPDCP). Before fining, the Center weighs the severity and duration of the violation, the number of people affected, whether it was intentional or negligent, and what corrective steps were taken — minor violations may get a warning instead of a fine.

Why it matters for a business

Law 195/2024 is Moldova's counterpart to the EU's GDPR. It is already in force, and the data-protection authority has the right to inspect websites and issue orders and fines.

Any visitor can complain — it is enough to open the site and see analytics running without asking. An investigation and a fine hit not only the budget but the reputation.

Almost every violation is technical: the wrong script-loading order, an outdated banner, an incomplete policy. These are fixed in a day or two once you know exactly what is wrong.

Verific shows whether you have obvious problems — before a regulator, a client, or a competitor spots them.

Free SEO check

After this check you can also test your site’s SEO for free — here.

Verific — a technical self-check for Law 195/2024