Checked on 10/23/2026 · https://onboarding.medirect.com.mt/
Best-case value: the issues found are the minimum. Behind a tag manager or cookie banner, further services can load that this scan does not see — the real value is likely lower.
Critical items: 2 · also to review: 1.
| Google Fonts (loaded externally): Google Fonts (CSS) | -10 |
| Tag manager: Google Tag Manager | -12 |
| Tag manager loads further scripts unchecked | -6 |
| 2 cookie(s) set on first load | -8 |
| Privacy-policy link not found in the initial HTML (possibly via JavaScript) | -3 |
| Result | 61 / 100 |
Multiple services of the same kind count on a sliding scale. The score is a guide, not a legal verdict.
Cookies set on first load: 0819bd64eab4d6528f5fa63f029d2465, TS0195920c
The delivered HTML contains almost no content. Trackers, cookie banner and legal texts are loaded only in the browser and are only partly visible here. The active scan in monitoring renders the page in full.
What you should do: For a reliable result, check this page with the browser developer tools (“Network” tab, reload the page) — or use monitoring, which renders the page for real.
On page load the visitor's IP address goes to Google (USA). In the DACH region the most common cease-and-desist reason.
What you should do: Embed the fonts locally: download the font files, serve them from your own server via @font-face and remove the calls to fonts.googleapis.com / fonts.gstatic.com. In WordPress, plugins such as “OMGF” handle this.
LG München I, judgment of 20 Jan 2022 – 3 O 17493/20 (€100 damages for dynamically loaded Google Fonts).
Analytics, advertising or social services load without any consent solution being detectable.
What you should do: Add a consent tool that loads these services only after active consent (not just displays a banner). Until then, remove the scripts or switch to consent-free alternatives.
§ 25 (1) TDDDG together with Art. 6 (1) GDPR — access to terminal equipment only with prior consent.
Set without a consent banner: 0819bd64eab4d6528f5fa63f029d2465, TS0195920c. Only technically necessary cookies are permitted without consent.
What you should do: Check which of these cookies are really technically necessary (session, cart, language setting). Set everything else — especially analytics/marketing — only after consent.
§ 25 (2) TDDDG — exception only for strictly necessary cookies.
A privacy policy must be directly reachable from every page.
What you should do: Place a “Privacy” link permanently in the footer so it is visible on every subpage.
Art. 13 GDPR — duty to inform when collecting personal data.
Not privacy-relevant, but a sign of a sloppy base configuration and bad for accessibility.
What you should do: Set the language on the <html> tag, e.g. <html lang="en">.
| Service | Purpose | Vendor | Country | Legal basis |
|---|---|---|---|---|
| Cloudflare Turnstile / Challenge challenges.cloudflare.com |
technically necessary function (e.g. payment, bot protection) | Cloudflare Inc. | US ⚠ | permitted without consent |
| Google Fonts (CSS) fonts.googleapis.com |
Web fonts; the request transmits the visitor's IP to the provider | Google LLC | US ⚠ | Consent required — or host the fonts locally |
| Google Tag Manager www.googletagmanager.com |
loads further scripts — content depends on the configuration | Google LLC | US ⚠ | Consent required once it loads non-essential items |
⚠ Established outside the EU/EEA — the transfer needs an additional basis (e.g. the EU-US Data Privacy Framework or standard contractual clauses).
Weekly re-scan, email as soon as a new tracker appears — coming soon.
On 10/23/2026 we checked the HTML that onboarding.medirect.com.mt delivers on first load without a login (normal desktop browser, EU location). Detected: services embedded in the source (scripts, stylesheets, iframes, pixels), a cookie banner based on known providers, cookies from the server response, and links to the privacy policy and legal notice.
Not checked: anything that loads only via JavaScript, content behind a login, subpages, behaviour after clicking “Accept”/“Reject”, server locations and data-processing agreements. The result is an automated snapshot and not a substitute for legal advice.