Skip to content
Conformly
Sign inScan a store

Storefront scan · 9 checks · 12 pages

EU storefront compliance, checked and watched.

Four EU rules landed on online shops in fifteen months. Paste a store URL and get a pass/fail matrix with evidence, the legal citation and a fix for each.

One free scan, no account. Results stay on a private link for 30 days.

Conformly reports issues found with citations. It is not legal advice.

nordlicht-home.example

· 11 pages

3 issues2 warnings1 unknown

  1. 01withdrawal_functionfail
  2. 02withdrawal_policypass
  3. 03green_claimsfail
  4. 04accessibility_statementwarn
  5. 05a11y_samplewarn
  6. 06ai_disclosurepass
  7. 07cookie_parityunknown
  8. 08legal_noticefail
  9. 09eu_targetinginfo

Finding 01 · severity high

No on-site withdrawal function

fail

withdrawal_function

Evidence

https://nordlicht-home.example/

“Footer links: Returns, Contact, Imprint”

Citation

Directive (EU) 2023/2673, Art. 11a

Fix

<a href="/account/withdraw">
  Withdraw from contract
</a>

Shopify: add the link to the footer menu and the order status page, then confirm in two steps.

Example report for a synthetic store. Real reports list every finding, not only the first.

§ 1

Four rules in fifteen months

Each one changes what a shop has to show on its own pages. Enforcement starts with warning letters from competitors and complaints from consumer groups, which reach small shops first.

  1. European Accessibility Act

    Directive (EU) 2019/882

    Shops must meet EN 301 549, publish an accessibility statement and offer a way to complain.

  2. Withdrawal function

    Directive (EU) 2023/2673

    Shops must offer an on-site “withdraw from contract” function with two-step confirmation; an email address is not enough.

  3. AI Act, Article 50

    Regulation (EU) 2024/1689

    A chatbot must tell people they are talking to an AI system, unless that is obvious.

  4. Green claims

    Directive (EU) 2024/825

    Generic claims such as “eco-friendly” need recognised proof; offset-based neutrality claims and self-made labels are banned.

Conformly also checks two older duties that scanners rarely bundle: a cookie banner where rejecting is as easy as accepting, and a complete legal notice.

§ 2

Nine checks, each with its citation

Every check returns pass, warn, fail or unknown, with the page and quote it rests on. Eight decide by rule alone. One uses a model, and says so.

  1. 01. On-site withdrawal function

    withdrawal_function

    A link or button labelled as a withdrawal function, in any EU language, on the footer, legal, account or order pages. Fails when there is none; warns when the only route is a downloadable form or an email address.

    Decides by
    rule
    Cites
    Directive (EU) 2023/2673, Art. 11a

  2. 02. Withdrawal policy states 14 days

    withdrawal_policy

    A returns or withdrawal policy page that states the 14-day period: 14 days, fourteen, 14 Tage, 14 jours and equivalents.

    Decides by
    rule
    Cites
    Directive 2011/83/EU, Art. 6(1)(h) and Art. 9

  3. 03. Generic environmental claims

    green_claims

    Sentences that a multilingual keyword filter marks as environmental. A model sorts each into generic and unsubstantiated, specific and substantiated, or not environmental, and suggests a rewording. Offset-based “carbon neutral” claims and self-made labels are flagged by rule.

    Decides by
    rule + model
    Cites
    Directive (EU) 2024/825, Annex I, points 2a, 4a, 4c

  4. 04. Accessibility statement and complaint channel

    accessibility_statement

    A link to an accessibility statement, statement language on that page, and an email address or form for complaints. The report notes the exemption for micro-enterprises providing services.

    Decides by
    rule
    Cites
    Directive (EU) 2019/882, Art. 13(2) and Annex V

  5. 05. Accessibility sample

    a11y_sample

    Five technical checks: a lang attribute, exactly one h1, images without alt text, inputs without labels and links with no text.

    A sample, not a WCAG audit. A full audit needs a browser and a person; Conformly does neither.

    Decides by
    rule
    Cites
    EN 301 549 / WCAG 2.1 SC 1.1.1, 1.3.1, 2.4.4, 3.1.1

  6. 06. Chatbot disclosure

    ai_disclosure

    Chat widgets loaded from known hosts such as Intercom, Tidio, Gorgias or Shopify Inbox. When one is present, it looks for words that tell people they are talking to an AI system, on the page or in the privacy policy.

    Decides by
    rule
    Cites
    Regulation (EU) 2024/1689, Art. 50(1)

  7. 07. Reject as easy as accept

    cookie_parity

    A consent banner in the page markup with an accept button and a reject button at the same level. Warns when only accept is offered.

    Banners injected by JavaScript are not visible to the crawler and are reported as unknown.

    Decides by
    rule
    Cites
    Directive 2002/58/EC, Art. 5(3); Regulation (EU) 2016/679, Art. 7

  8. 08. Legal notice completeness

    legal_notice

    An imprint or legal notice page with a postal address, an email address, and a company registration or VAT number.

    Decides by
    rule
    Cites
    Directive 2000/31/EC, Art. 5(1)

  9. 09. EU targeting (informational)

    eu_targeting

    Prices in euro, shipping to EU countries and EU-language pages. It explains why the rules above apply to the store; it is never counted as an issue.

    Decides by
    rule
    Cites
    CJEU, Joined Cases C-585/08 and C-144/09 (Pammer)

Stores that render their pages with JavaScript are reported as a limitation of the scan, not as issues.

§ 3

A report you can forward

Each scan produces one page on a private link. It reads like a short audit document, so it can go straight to whoever maintains the store.

nordlicht-home.example

· 11 pages

3 issues2 warnings1 unknown

Matrix

  1. 01 withdrawal_functionfail
  2. 02 withdrawal_policypass
  3. 03 green_claimsfail
  4. 04 accessibility_statementwarn
  5. 05 a11y_samplewarn
  6. 06 ai_disclosurepass
  7. 07 cookie_parityunknown
  8. 08 legal_noticefail
  9. 09 eu_targetinginfo

Finding 03

failrule + model

Generic environmental claim

“Our eco-friendly packaging is kind to the planet.”

Directive (EU) 2024/825, Annex I, point 4a

Packaging: 80% recycled cardboard, FSC Recycled certified.

Pages crawled · 11

  • /home
  • /products/linen-throwproduct
  • /products/oak-trayproduct
  • /cartcart
  • /pages/imprintlegal
  • /pages/returnslegal
  • + 5 more

Limitations

  • The cookie banner is injected by JavaScript, so cookie_parity is unknown.
  • a11y_sample is a sample of five checks, not a WCAG audit.
The same synthetic store, as a full report page. Letters match the list.

  1. A. Summary strip

    The store, the scan date, how many pages were read, and the count of issues, warnings and unknowns. Never a percentage, never a pass mark.

  2. B. Matrix

    One verdict per check, in the same order and numbering as the list above. On the full page it runs down the left side and links to each finding.

  3. C. Findings

    Each issue as a numbered section: the quote and page it came from, the provision it relates to, and a fix as generic HTML with a Shopify note.

  4. D. Pages crawled

    Every URL that was read and what kind of page Conformly took it for, so you can see what the verdicts rest on.

  5. E. Limitations

    What the scan could not see: banners injected by JavaScript, pages blocked by robots.txt, checks that are samples. Stated on every report.

§ 4

Re-scanned every month

Storefronts change: a new theme drops the withdrawal link, an app adds a chat widget. Pro re-scans each monitored site every 30 days and compares the result with the last scan.

  • New findings since the last scan, with the evidence that triggered them.
  • Resolved findings, so a fix is on record.
  • Changed evidence on findings that are still open.
  • An email to the site owner when the findings change. Findings marked fixed or not applicable carry over to the next scan, with the reason.

nordlicht-home.example

Re-scan against

  • + Newcookie_paritywarn
  • − Resolvedlegal_noticefail
  • ~ Changedgreen_claims: one evidence quote rewritten

Alert emailed to the site owner. Next re-scan in 30 days.

Example change alert for the synthetic store.

§ 5

Method and limits

A scanner that reads other people's shops should be predictable about how it does it.

No JavaScript
Pages are fetched server-side and read as HTML. Nothing on your store is executed, clicked or submitted. Stores that render with JavaScript are reported as a limitation, not guessed at.
robots.txt honoured
Paths your robots.txt disallows are not fetched.
12 pages at most
Home, up to four product pages, cart and checkout entry, legal pages and the account link. Each request times out after 10 seconds.
Identified user agent
Requests carry a Conformly user agent, so your server logs show who called.
30-day purge
Anonymous scans, their crawled text and their findings are deleted 30 days after the scan.
Synthetic demo data
The example store on this site lives on a reserved .example domain, and the test fixtures are synthetic storefronts. No real shop is named.
Every model call logged
The green-claims classifier is the only model call. Each one is logged with the model, the prompt version and the token counts.

§ 6

Pricing

The first scan needs no account. An account keeps your history; Pro watches your sites.

  • Free

    €0no card needed

    For checking your own shop before the warning letters arrive.

    • 5 scans a month
    • Scan history
    • 1 monitored site
    Create a free account

  • Pro

    Monitoring

    €19per month

    For agencies and shops that change their storefront often.

    • Unlimited scans
    • 10 monitored sites
    • Monthly re-scan with change alerts
    • PDF report
    • Team notes on findings
    Choose Pro

Stripe runs in test mode on this demo. Checkout accepts Stripe’s published test cards only, and no real payment is taken.

Compare the plans in full

§ 7

Questions

Is this legal advice?

No. Conformly reports issues found, with the evidence it read and the provision each one relates to. It never says a store is compliant: a report with no issues means these nine checks found nothing on the pages they could read.

For a decision about your shop, ask a lawyer qualified in the countries you sell to.

Which countries does it cover?

The checks follow EU directives and regulations, which apply to shops selling to consumers in any member state, wherever the shop itself is based. It reads pages in English, German, French, Italian, Spanish and Dutch.

The UK’s Digital Markets, Competition and Consumers Act brings its own consumer rules in spring 2027. Reports flag it as upcoming; it is not checked yet.

Does it run JavaScript?

No. Pages are fetched server-side and read as HTML, the way a search engine’s first pass would. That keeps the scan safe for your store, but anything a script adds after load, such as many cookie banners and chat widgets, may not be visible. When that happens the check is reported as unknown and the limitation is listed, rather than guessed.

Does it use AI?

Only to classify environmental claims. A keyword filter picks out candidate sentences and a model sorts them into generic, specific or not environmental, with a suggested rewording. The verdicts for every other check are rules you can read in the source code, and every model call is logged.

Can it scan Shopify or WooCommerce stores?

Yes. Standard Shopify and WooCommerce themes render their pages on the server, so the crawler sees what a customer sees. Fixes come as generic HTML with a Shopify note. Headless storefronts built as JavaScript apps often return little HTML; the report says so instead of reporting false issues.

End of document

Start with one URL.

One free scan, no account. The report stays on a private link for 30 days.

Scan a store