How Dxtra reads any site the way a regulator does.

What the scan is — and isn't

Dxtra reads a site's public surface and assesses it against the obligations a regulator would expect to see evidenced there. It is an automated indicator that points you to where attention is likely needed. It is not legal advice and not a determination that any law has been breached — that is a judgment only a qualified privacy professional can make on the full facts.

Because it works from the outside, the scanner cannot see your contracts, internal records, processing purposes, or anything behind a login. The absence of something on the site's public surface is treated as a prompt to check, not as proof of non-compliance.

The three scan agents

Every scan runs three agents over the site's public surface, each with a clearly defined job:

Surface Agent — reads the site's public pages (homepage, footer, policy links) as static HTML, discovering its privacy notice, rights routes and other published material.

Browser Agent — drives a real headless browser to observe live behavior: cookies, trackers and marketing pixels before any consent, plus a simulated Reject All and a Global Privacy Control signal. All tracker and consent evidence is attributed to this agent.

Policy AI — reads the site's privacy notice for the substance regulators expect (rights, transfers, retention, contacts and disclosures). Deep policy analysis is attributed to the Policy AI.

The headline is a risk band — the number is just a progress meter

Every scan returns one of three risk bands — Low, Medium or High. The band is the headline and the only thing that carries weight. It is set by the count of confirmed high- and medium-severity findings under the methodology's Appendix B thresholds, under the law the report is scored under.

Since Methodology v1.11 a finding counts toward the band only where Dxtra’s citation register grounds it in a provision of that law. A finding the register does not ground is still shown, for reference, and does not count. Findings that rest on one provision count once, at the highest severity among them: trackers firing before consent and a remarketing beacon firing before consent are one grounded provision, not two. Since methodology v1.22, this applies to reports scored under California law as well.

We show a 0–100 figure alongside the band, but it is deliberately secondary. It summarizes the privacy information, mechanisms, and behaviors our scan finds on the site's public pages, scored by our published method. A website scan can assess up to 71 of the 100 points. The remaining 29 cover practices, such as breach handling and internal assessments, that cannot be seen from public pages. They are counted on the business's own confirmation, which Dxtra does not check; a scan does not mark them as gaps. The number does not mean every privacy practice is in place, that every area could be assessed, or that the business complies with the law. It is not a percentage, a grade, or a league-table position, and it never changes the band. Two sites in the same band can show different numbers simply because one shows more of these practices publicly. The Dxtra verified badge is separate from this number and is not earned by reaching a score.

Sites that process higher-sensitivity data — health, biometric, financial, child-directed, AI significant-decisioning, or Washington MHMDA scope — are assessed against tightened bands, because regulators expect more of them: a single high-severity finding can place such a site in the High band.

Commendable practices (above-baseline things you already do well — a transparency hub, a published sub-processor list) are recognized and can lift the 0–100 figure, but they are informational only — they never move the risk band.

What Low, Medium and High mean

The band is set purely by how many confirmed High and Medium findings the site's public surface shows, under the methodology's Appendix B thresholds — counted once per register provision, and only where the register grounds the finding, as described above. Higher-sensitivity sites are held to the tightened column on the right, because regulators expect more of them.

A site is treated as elevated when the scan sees any of these triggers: health, biometric, financial, child-directed, AI significant-decisioning, Washington MHMDA consumer health data, EU AI Act Art.5 scope, mandatory cross-border pathway. Any number shown alongside the band is a presentational composition summary only — it is not the headline and not a regulatory determination.

US sites (Option C). Where no single US state places the business, Dxtra measures the site against every requirement in any of the US state privacy laws it holds. Each counted item names the states that require it and the size from which each law applies. Most of these laws apply only above set sizes, so a counted item does not mean any of them applies to this business.

California, 12 months. On reports graded against California law, a privacy notice whose latest date is more than 12 months before the scan counts at High, because California law requires the information in the notice to be updated at least once every 12 months. Reports made before 16 October 2026 are unchanged.

California reports.Reports graded against California law are now scored like other register-backed reports: a finding counts toward the band only where Dxtra’s register grounds it in a provision of California law, and once per provision. Ad and marketing pixels are shown on California reports but do not count toward the band; the opt-out items do. Earlier California reports are shown under this rule where it lowers their band, never where it would raise it.

Appendix B’s Medium cell for standard sites now reads ‘1 high, or 3+ medium’, which is how bands have always been set. Earlier versions said ‘0-1 high, 3+ medium’. No band changes.

Methodology v1.23 replaces the framework references shown beside each finding with references Dxtra has checked against the NIST Privacy Framework (Version 1.0) and ISO/IEC 27701:2025, and removes the ENISA reference. No band changes.

Methodology v1.24 shows the 0–100 figure on one scale, as observed privacy practices, and separates it from the Dxtra verified badge. Three finding titles now say “before any consent choice”, and four catalogue texts are corrected. No band changes.

Overseas transfers: from October 29, 2026, the scan looks for wording about sending personal data to other countries on the homepage, the cookie page, the privacy notice, the terms of use, and up to three other privacy pages on the same site linked from the footer or the privacy notice. It counts named transfer safeguards, such as standard contractual clauses, or a statement that personal data is stored, processed or sent outside the country or to a named country other than the site's own. The words "transfer" or "international" on their own no longer count. The scan does not read contracts with service providers, PDF files, or notices given in other ways.

Japan: since October 26, 2026, advertising requests sent before any consent choice was seen are shown but not counted toward the risk band under Japanese law, following the Personal Information Protection Commission's Q&A (Q8-10). Stored reports were re-graded only where this lowered their band.

No band is not the same as no issues. When a report has no overall band but still shows high-severity observations, we add one line saying so. It names the kinds of tools we saw, and the stricter rules Dxtra holds that would grade them. It never shows another country's band.

Every finding is anchored

Nothing is asserted on a hunch. Each finding maps to a named regulator source. Most findings also show a related NIST Privacy Framework (Version 1.0) reference and related ISO/IEC 27701:2025 Annex A controls. Both mappings are Dxtra’s own and do not mean a site conforms to either framework. A mapping to Singapore Standard SS 714:2025 is planned.Regulator citations, finding identifiers, dates and statutory instruments come from the published Regulator Reference — they are never invented. Where something can't be confirmed from the public surface, the scanner records it as not evaluated rather than guessing.

The citation register — checked, not just cited

Since Methodology v1.10, citations are produced from a citation register: every provision carries its statutory heading verbatim as printed by the official publisher, with the evidence of how that text was retrieved. On this service, Dxtra enforces the register strictly for Malaysia, the EU, Japan, the UK, Singapore, Australia and California: there, a citation written by Dxtra’s AI that does not resolve against the register is refused, not rendered. Dxtra’s fixed citations are checked against the register each time the scanner is built, and any allowed to stand without resolving are listed by name in that check. Each report names one law that Dxtra grades it against. Dxtra chooses it from what the site’s own pages show about the business — where the operator is established, its address, or a licence or registration it prints — then from the site’s country web address, and only as a last resort from the place the scan ran from. Where the law was chosen from the web address or the scan’s location, the report says it is graded against that law if it applies. That law’s provisions lead each finding’s sources; provisions of other regimes are labelled as such and never set the band. Free scans choose the law the same way and name it on the page. Provisions repealed or substituted in that law are guarded and never cited. The published Regulator Reference (v2.0 onward) is generated from this register mechanically, so the document you read and the rules the scanner enforces cannot drift apart. None of this is counsel clearance — rows verified internally say so, and negative determinations awaiting practitioner review render in wording that names them as Dxtra’s own reading, open to challenge.

Findings catalog

Each finding on your report carries a short code (for example M13). The code is a stable reference into this catalog — not a score. Here is every code the scanner can return, in plain language, with the regulator source it maps to. Codes beginning F are high-severity, M medium, L low. A code only appears on your report when the scan actually observed that gap on the site's public surface.

"What it checks" describes the public-surface signal, not internal detector logic. Commendable practices (codes beginning C) are recognized separately and never move the band.

Cross-border sites

When a site shows signs of reaching more than one country, the band is set under the law Dxtra grades the report against, and each other country the site names is shown in its own panel entry, graded under that country’s register where Dxtra holds one. A clean result from one vantage is reported as "not observed from this vantage" — never as "compliant" — because the absence of a finding in one country is not evidence of compliance in another.

When a site limits access

Some sites rate-limit or block automated visitors. When that happens the scanner does not fail silently or invent results: it returns a preliminary, access-limited assessment with an explicit banner, reports only what it could directly observe, and withholds any finding that depends on having fully read the site. You always know what was — and wasn't — established.

The same rule applies to our own failures, and it applies to how we look as well as whether we could. The live pass visits your site over HTTPS. If that connection fails we do not retry over plain HTTP: a response served over a scheme your site refuses is not evidence about your site. Secure cookies are neither sent nor set over plain HTTP, consent platforms and most tracking vendors load over HTTPS only, so such a page would under-report exactly the things this scan exists to observe — and it would under-report them in the flattering direction. We would rather record that we saw nothing than record something we would have to discard.

And when the failure is ours — our network route to your site, not your site's response to us — the report says so in those words. A fault on our side is never presented as a finding about you.

Canonical reference documents

This page is the plain-language summary. The full, citable source documents are published openly: the complete methodology and the regulator reference — every regulator source, statutory instrument and enforcement decision behind the finding catalog.

Scanner methodology (full) ↗ · Regulator reference ↗

Known limitations

10 October 2026. Before 8 October 2026, the scanner did not check the country of the address it used for the live browser visit. Checks since then found that some visits requested from the United States left from addresses in other countries; earlier visits from that location may have done the same. Reports made before that date are shown as they were made.

How the law a report is measured against is chosen: two rules added on 10 October 2026

Reports made from 10 October 2026 follow two rules.

1. The scan’s location must be confirmed. A law is taken from the country a scan was requested from only where the scan confirms its visit came from there: either the network location the visit used was checked at the start and the end of the visit and was in that country (for California, in that state), or the scanner ran from its own servers in that country’s region. Otherwise no law is taken from where the scan ran, and the report shows no overall band.

2. A governing-law clause only supports other evidence. A clause in the operator’s own terms naming the law that governs them, such as “governed by English law”, supports other evidence that a site serves the European Union or the United Kingdom. On its own, it no longer brings in the EU or UK standard.

Each report records the rules it was made under. Reports made before these rules applied, including some made earlier on 10 October, are shown as they were made.

Versioning

The current ratified methodology is Methodology v1.25 (with Regulator Reference v2.0). It incorporates the geo-vantage addendum governing multi-region scans — disclosing the vantage each result was observed from and the rule that absence ≠ compliance. The methodology is versioned and auditable, and findings are reproducible against the published rules.