Saved copy — Methodology v1.19
This is the text of Dxtra’s public methodology page as saved on 2026-10-12. A report that prints “Methodology v1.19” was assessed against this text. A later version is in force. The current methodology page may differ.
SHA-256 of the text, whitespace removed: b7ea3618dc7699e3f3ab51215ad3b0ac292e6aa08bae489e58b97b5b79e7310e
Scan methodology
How Dxtra reads any site the way a regulator does.
The scanner is a diagnostic indicator, not a legal opinion. It reads only what is public, maps what it observes to named regulator sources and recognized control frameworks, and returns a Low / Medium / High risk band as the headline — with a secondary 0–100 maturity indicator, never a single grade. Here is exactly how.
What the scan is — and isn't
Dxtra reads a site's public surface and assesses it against the obligations a regulator would expect to see evidenced there. It is an automated indicator that points you to where attention is likely needed. It is not legal advice and not a determination that any law has been breached — that is a judgment only a qualified privacy professional can make on the full facts.
Because it works from the outside, the scanner cannot see your contracts, internal records, processing purposes, or anything behind a login. The absence of something on the site's public surface is treated as a prompt to check, not as proof of non-compliance.
The three scan agents
Every scan runs three agents over the site's public surface, each with a clearly defined job:
Surface Agent — reads the site's public pages (homepage, footer, policy links) as static HTML, discovering its privacy notice, rights routes and other published material.
Browser Agent — drives a real headless browser to observe live behavior: cookies, trackers and marketing pixels before any consent, plus a simulated Reject All and a Global Privacy Control signal. All tracker and consent evidence is attributed to this agent.
Policy AI — reads the site's privacy notice for the substance regulators expect (rights, transfers, retention, contacts and disclosures). Deep policy analysis is attributed to the Policy AI.
The headline is a risk band — the number is just a progress meter
Every scan returns one of three risk bands — Low, Medium or High. The band is the headline and the only thing that carries weight. It is set by the count of confirmed high- and medium-severity findings under the methodology's Appendix B thresholds, under the law the report is scored under.
Since Methodology v1.11 a finding counts toward the band only where Dxtra’s citation register grounds it in a provision of that law. A finding the register does not ground is still shown, for reference, and does not count. Findings that rest on one provision count once, at the highest severity among them: trackers firing before consent and a remarketing beacon firing before consent are one grounded provision, not two. Reports scored under California law keep the earlier grading, in which every confirmed finding counts, until that register is complete.
The headline
Risk band
Low / Medium / High, driven by confirmed findings. This is what you act on.
Secondary
0–100 maturity
How far the site's public surface is from the 91/100 verified-badge threshold. A progress meter, not a grade.
We show a 0–100 figure alongside the band, but it is deliberately secondary. It is a capability-maturity indicator: a measure of how much of a credible privacy program is already evidenced on the site's public surface, and how far that is from the 91/100 threshold a site needs to reach to earn a Dxtra verified badge. It is not a regulatory determination, not a grade or league-table position, and it never changes the band. Two sites in the same band can show different numbers simply because one has more above-baseline practice visible.
Sites that process higher-sensitivity data — health, biometric, financial, child-directed, AI significant-decisioning, or Washington MHMDA scope — are assessed against tightened bands, because regulators expect more of them: a single high-severity finding can place such a site in the High band.
Commendable practices (above-baseline things you already do well — a transparency hub, a published sub-processor list) are recognized and can lift the 0–100 figure, but they are informational only — they never move the risk band.
What Low, Medium and High mean
The band is set purely by how many confirmed High and Medium findings the site's public surface shows, under the methodology's Appendix B thresholds — counted once per register provision, and only where the register grounds the finding, as described above. Higher-sensitivity sites are held to the tightened column on the right, because regulators expect more of them.
Band
Standard site
Elevated-sensitivity site
Low
0 high, 0-2 medium
0 high, 0-1 medium
Medium
0-1 high, 3+ medium
0 high, 2+ medium
High
2+ high
1+ high
A site is treated as elevated when the scan sees any of these triggers: health, biometric, financial, child-directed, AI significant-decisioning, Washington MHMDA consumer health data, EU AI Act Art.5 scope, mandatory cross-border pathway. Any number shown alongside the band is a presentational composition summary only — it is not the headline and not a regulatory determination.
No band is not the same as no issues. When a report has no overall band but still shows high-severity observations, we add one line saying so. It names the kinds of tools we saw, and the stricter rules Dxtra holds that would grade them. It never shows another country's band.
Every finding is anchored
Nothing is asserted on a hunch. Each finding maps to a named regulator source and to a recognized control framework: the NIST Privacy Framework v1.1, ISO/IEC 27701:2025, and an ENISA-style assessment of likelihood × impact × sensitivity. Regulator citations, finding identifiers, dates and statutory instruments come from the published Regulator Reference — they are never invented. Where something can't be confirmed from the public surface, the scanner records it as not evaluated rather than guessing.
The citation register — checked, not just cited
Since Methodology v1.10, citations are produced from a citation register: every provision carries its statutory heading verbatim as printed by the official publisher, with the evidence of how that text was retrieved. In regimes under strict enforcement — Malaysia, the EU, Japan, the UK, Singapore and Australia as of August 2026 — a citation that does not resolve against the register is refused, not rendered. Reports resolve one applicable regime to lead each finding’s sources (considering the scan vantage and, where the public surface evidences it, the operator’s place of establishment) and label everything else as a benchmark. Free scans resolve the regime through the same pipeline and name it on the page; provisions repealed or substituted in the applicable regime are guarded and never cited there. The published Regulator Reference (v2.0 onward) is generated from this register mechanically, so the document you read and the rules the scanner enforces cannot drift apart. None of this is counsel clearance — rows verified internally say so, and negative determinations awaiting practitioner review render in wording that names them as Dxtra’s own reading, open to challenge.
Findings catalog
Each finding on your report carries a short code (for example M13). The code is a stable reference into this catalog — not a score. Here is every code the scanner can return, in plain language, with the regulator source it maps to. Codes beginning F are high-severity, M medium, L low. A code only appears on your report when the scan actually observed that gap on the site's public surface.
High-severity findings (F)
F1Missing privacy noticeHigh
What it checks: No privacy notice linked from any inspected page/footer. · Regulator source: GDPR Art.13-14 · CCPA s.1798.130 · LGPD Art.9 · PIPL Art.17 · Australia APP5 · PDPA Notification (SG/MY/TH) · DPDPA s.5 · Act respecting the protection of personal information in the private sector (CQLR c. P-39.1) s. 8.2 · Washington MHMDA · nFADP Art.19 · PIPA Art.30 · UAE/NG/SA notice duties
F2Stale / out-of-date privacy notice (or repealed law)High
What it checks: Last-updated date >24 months, or references repealed legislation (DPA 1998, Privacy Shield, pre-Schrems-II SCCs). On Australian leads, a privacy notice dated more than 24 months before the scan is counted once, at the same weight as M1, under APP 1.3's requirement for an up-to-date policy. A date alone does not show whether the policy is current. · Regulator source: ICO accountability guidance · EDPB transparency guidelines
F3Tracker requests before consentHigh
What it checks: Tracking cookies/pixels/fingerprinting fire in first 3s before any interaction. · Regulator source: CNIL SAN-2025-005 (SHEIN) · EDPB Guidelines 02/2023 · ePrivacy Art.5(3)
F4Implied or pre-enabled consentHigh
What it checks: Banner infers consent from continued use ('by continuing you accept'), OR non-essential cookies are pre-enabled/pre-ticked by default (opt-out rather than opt-in). · Regulator source: EDPB Guidelines 05/2020 · DSA Art.25(1)
F5Unequal Accept/Reject prominenceHigh
What it checks: Accept All visually dominant or Reject hidden behind intermediate menu. · Regulator source: CNIL SAN-2025-005 · EDPB Guidelines 03/2022
F6Trackers persist after Reject AllHigh
What it checks: Simulated Reject All; trackers continue to fire. · Regulator source: CNIL SAN-2025-005 · EDPB Guidelines 02/2023
F7Ad/marketing pixels fire without consentHigh
What it checks: Meta/Google/Bing/TikTok/LinkedIn pixels load before consent. On Malaysian leads it is counted only where the scan saw the site send an identifier it holds about a visitor to an advertising service before the visitor made any choice; otherwise it is shown and not counted. · Regulator source: PECR reg. 6 · EDPB Guidelines 05/2020 & 02/2023
F8No DSAR mechanismHigh
What it checks: No rights-request page, portal, or designated contact for access requests. · Regulator source: GDPR Art.12-22 · CCPA s.1798.100 · LGPD Art.18 · DPDPA s.11-14 · PIPL Ch.IV · APP 12 (Australian Privacy Principle 12—access to personal information) · APP 13 (Australian Privacy Principle 13—correction of personal information) · Thailand PDPA s.30-42
F9No appointed privacy officer (mandatory jurisdictions)High
What it checks: No DPO/SRI/CPO/Encarregado/Quebec officer publicly contactable where mandatory. · Regulator source: GDPR Art.37-39 · Malaysia PDPA s.12A · Thailand PDPA s.41 · LGPD Art.41 · Act respecting the protection of personal information in the private sector (CQLR c. P-39.1) s. 3.1 · PIPA Art.31 (KR) · Saudi PDPL DPO · UAE PDPL Art.10 · Nigeria NDPA DPO (major importance) · HIPAA §164.530(a)
F10Opt-out preference signal sent; ad storage still reported granted (California duty cited for reference)High
What it checks: The scan sends an opt-out preference signal and checks whether advertising beacons still report ad storage as granted (California). · Regulator source: Cal. Code Regs. tit. 11 §7025 · Healthline · CA/CO/CT GPC sweep · California Opt Me Out Act (AB566)
F11ADMT for significant decisions without pre-use notice (California)High
What it checks: ADMT for significant decisions affecting CA residents; no pre-use notice. · Regulator source: CCPA regs §7200-7221
F12Cross-border transfer without documented lawful basisHigh
What it checks: Transfers PI of CN/MY/BR/KR users abroad without the mandatory pathway/separate consent. · Regulator source: PIPL Art.38-39 · China CBDT Certification Measures · Malaysia CBPDT · Brazil ANPD Res.19/2024 · PIPA Art.28-8 (KR separate consent) · Saudi cross-border Regulation · UAE PDPL Art.22-23
F13EU AI Act Article 5 prohibited-practice patternHigh
What it checks: Public surface describes/deploys patterns suggestive of Art.5 prohibitions. · Regulator source: EU AI Act Art.5 · EC Guidelines on Prohibited AI
F15Washington MHMDA: separate consumer health data policy missingHigh
What it checks: Processes WA consumer health data; no separate, prominently-linked health-data policy. · Regulator source: Washington MHMDA RCW 19.373.020 (PRA under WA CPA) · Nevada SB370 (no PRA)
F16Marketing signup form with no consent wording or privacy-notice link beside itHigh
What it checks: An email/SMS marketing signup form or pop-up (typically a marketing-platform in-app form — Klaviyo, Mailchimp, Omnisend, Privy) collects an address FOR MARKETING with no consent statement, no controller/purpose disclosure and no privacy-notice link at the point of collection. Browser Agent renders the pop-up. Distinct from M30 (contact/inquiry form — transparency only) and F7/L4 (tracking pixels, ePrivacy Reg.6). JURISDICTION-AWARE: a consent breach in opt-in regimes (UK/EU/CA/AU/KR/JP); a transparency + notice-at-collection gap in opt-out email regimes (US CAN-SPAM / CCPA). CHANNEL-AWARE: a phone number captured for marketing texts requires opt-in even in the US (TCPA). · Regulator source: PECR Reg.22 · UK GDPR Art.13 & Art.5(1)(a) · UK GDPR Art.4(11)/Art.7 & Recital 32 · EDPB Guidelines 05/2020 · ePrivacy Directive Art.13 · Canada CASL s.6 & s.10 · Australia Spam Act 2003 s.16 · US CAN-SPAM 15 U.S.C. §7704 · US TCPA 47 U.S.C. §227 (SMS) · CCPA notice-at-collection s.1798.100(a)
Medium-severity findings (M)
M1Aging privacy notice (12-24 months)Medium
What it checks: Last-updated date 12-24 months. Counted on California and Australian leads, where the law asks for a privacy notice to be updated at least every 12 months (California) or kept up to date (Australia). On EU, UK, Singapore, Japanese, Malaysian and Hong Kong leads it is shown as advice and does not count toward the score. · Regulator source: ICO accountability guidance · EDPB transparency guidelines
M2No cookie banner where non-exempt tracking detectedMedium
What it checks: Non-exempt tracking present but no cookie-banner DOM pattern. · Regulator source: ePrivacy Art.5(3) · EDPB 02/2023 · PECR reg. 6
M3Third-party hosts not named in the noticeMedium
What it checks: Network-detected processors not named/categorized in the privacy notice (or no notice found). · Regulator source: GDPR Art.13(1)(e)
M4No privacy officer contact (general, non-mandatory)Medium
What it checks: No privacy contact where not strictly mandatory. · Regulator source: GDPR Art.37-39
M5No Transparency Center / privacy hubMedium
What it checks: No dedicated privacy hub beyond a single policy page. · Regulator source: EDPB transparency guidelines
M6No DPIA/PIA referencedMedium
What it checks: No DPIA/PIA/processing-risk assessment referenced. · Regulator source: GDPR Art.35 · Cal. Code Regs. tit. 11 §7150 · PIPL Art.55-56 · LGPD Art.38 · nFADP Art.22
M8No CCPA Do Not Sell or Share linkMedium
What it checks: CA-facing site sells or shares personal information (notice declaration or observed cross-context ad beacon) with no DNSMPI opt-out link. · Regulator source: Cal. Civ. Code s.1798.135 · Cal. Civ. Code s.1798.140(ah)(1) (definition of 'share') · Sephora
M9Cross-border transfer disclosures absent or staleMedium
What it checks: No/superseded international-transfer language (non-mandatory-pathway jurisdictions, incl. Switzerland adequacy list). · Regulator source: EDPB Recommendations 01/2020 · Swiss Federal Council adequacy list
M10No ROPA referencedMedium
What it checks: No record of processing activities referenced. · Regulator source: GDPR Art.30 · LGPD Art.37 · nFADP Art.12
M11No UK data protection complaints procedureMedium
What it checks: No complaints procedure (UK; high severity from 19 Jun 2026). · Regulator source: DUAA 2025
M12AI processing without disclosureMedium
What it checks: The privacy notice itself indicates the organisation processes personal data with AI, machine learning or automated decision-making, but describes that use only in general terms - e.g. 'product improvement', 'new services', 'business purposes' - without naming AI or model training/fine-tuning, the personal data involved, or how an individual can decline. Judge from the notice text alone. Do NOT raise this where the notice is silent on AI altogether: silence is not evidence the organisation uses it, and this pass receives no signal about the site's actual AI use. · Regulator source: PDPC AI Advisory (1 Mar 2024) · EU AI Act Art.50 · CCPA ADMT regs · Australia ADM transparency · PIPA Art.37-2 · nFADP Art.21
M13No GPC response disclosureMedium
What it checks: Privacy notice does not disclose GPC handling (or no notice found). · Regulator source: Cal. Code Regs. tit. 11 §7025
M14Malaysia PDPA: DPO contact not publishedMedium
What it checks: Malaysia-facing; DPO contact not published. · Regulator source: Malaysia PDPA s.12A · Circular 2/2025
M15DPDPA notice format missing (Indian-targeted)Medium
What it checks: India-facing; DPDPA Rule 3 notice elements absent. · Regulator source: DPDPA 2023; DPDP Rules 2025 Rule 3
M16Australia ADM transparency not addressedMedium
What it checks: Australia-facing; ADM transparency not addressed. · Regulator source: Privacy and Other Legislation Amendment Act 2024
M17Brazil LGPD: Encarregado contact not publishedMedium
What it checks: Brazil-facing; Encarregado/substitute contact not published. · Regulator source: LGPD Art.41 · ANPD Res.18/2024
M18Thailand PDPA: DPO not appointed/published (mandatory cases)Medium
What it checks: Thailand-facing mandatory case; DPO not published. · Regulator source: Thailand PDPA s.41 · Royal Gazette 9 Oct 2025
M19Brazil ECA Digital: minors' services without safeguardsMedium
What it checks: Brazil minors' service without required safeguards. · Regulator source: Law 15,211/2025 · ANPD Res.30/2025
M20EU AI Act Article 4 AI literacy indicators absentMedium
What it checks: No AI-literacy indicators where Art.4 applies. · Regulator source: EU AI Act Art.4
M21Privacy officer contact not publishedMedium
What it checks: Quebec-facing; privacy officer contact not on website. · Regulator source: Act respecting the protection of personal information in the private sector (CQLR c. P-39.1) s. 3.1 ¶3
M22Colorado AI Act: consumer-facing AI disclosure absentMedium
What it checks: Colorado consumer-facing AI without disclosure. · Regulator source: Colorado AI Act SB24-205
M23Non-cookie tracker fires before consentMedium
What it checks: Fingerprinting/tracking-link/local-processing Article 5(3) trackers fire pre-consent. · Regulator source: EDPB Guidelines 02/2023 · ePrivacy Art.5(3) · WP29 Opinion 9/2014
M24Local representative contact not publishedMedium
What it checks: CH nexus + foreign controller; no Swiss representative contact published. · Regulator source: nFADP Art.14
M25South Korea PIPA: CPO contact not publishedMedium
What it checks: KR nexus; no Chief Privacy Officer contact identifiable. · Regulator source: PIPA Art.31
M26South Korea PIPA: automated-decision rights not addressedMedium
What it checks: KR + automated decisioning; policy silent on refuse/explanation rights. · Regulator source: PIPA Art.37-2
M27UAE PDPL: DPO contact not published (interim)Medium
What it checks: Mainland-UAE nexus (not DIFC/ADGM) + DPO likely required; no DPO contact. · Regulator source: UAE Federal Decree-Law 45/2021 Art.10
M28Nigeria NDPA: DPO contact not published (major importance)Medium
What it checks: Nigeria nexus + 'major importance' signals; no DPO contact. · Regulator source: Nigeria Data Protection Act 2023 · NDPC GAID 2025
M29Saudi PDPL: DPO contact not publishedMedium
What it checks: Saudi nexus + DPO likely required; no DPO contact. · Regulator source: Saudi PDPL & Implementing Regulations (SDAIA)
M30Form collects personal data with no point-of-collection noticeMedium
What it checks: A contact/inquiry form collects personal data (email or phone + name/message) with no privacy notice or short data-use statement at the point of collection (the cookie banner does not satisfy this). TRANSPARENCY-ONLY: handling an inquiry rests on contract / legitimate interest (GDPR Art.6(1)(b)/(f)), so this is an Art.13 notice gap, NOT a consent defect — contrast F16 (marketing signup), which additionally needs consent. Surface Agent fetches the page and Browser Agent renders it, so JS/SPA forms are caught. On Malaysian leads it is counted, citing section 7 of the Personal Data Protection Act, which requires a written notice when a person is first asked to provide their personal data. It is not raised where no privacy notice was found at all. · Regulator source: GDPR Art.13 · PDPA s.20 (Notification of purpose) · CCPA notice-at-collection s.1798.100(a)
M31Live-chat / PII widget with no privacy noticeMedium
What it checks: A known live-chat / conversational widget (Intercom, Drift, Crisp, Zendesk, etc.) loads AND the site has no privacy notice — PII is collected in-conversation with no disclosure. Where a notice exists, surfaced as a verify-caution (report.chatWidgets) rather than a scored finding. · Regulator source: GDPR Art.13 · PDPA s.20 (Notification of purpose)
M32Privacy notice carries no effective/last-updated dateMedium
What it checks: A privacy notice was read but displays no determinable effective or last-updated date, so a reader cannot confirm how current it is. Distinct from F2 (stale = a parsed date over 24 months, or repealed law) and M1 (aging = 12-24 months): M32 is the no-date case, with no evidence the notice is out of date. Only visible text counts — a hidden or blank date label is not a displayed date. On Malaysian leads it is shown as advice, quoting the Personal Data Protection Commissioner's guidance, and does not count toward the score. · Regulator source: EDPB transparency guidelines
M34Privacy notice found, but the expected sections were not presentMedium
What it checks: A privacy notice page was located and returned real content. Our reading did not find the following in it: controller identity and contact, purposes and legal basis, recipients or processors, retention, cross-border transfers, and data-subject rights. Distinct from F1 (no notice linked at all) and M33 (notice hard to discover): here the notice EXISTS and is easily found. Because the content does not read as a complete notice, the individual content findings (rights, retention, processors, date) are not raised separately, so this single finding records the overall gap. · Regulator source: GDPR Art.13-14 · EDPB transparency guidelines · Australia APP1/APP5 · CCPA s.1798.130
M35Signposted privacy resource unreachable (special-category site)Medium
What it checks: The site processes special-category data (health/biometric) and its privacy notice signposts a separate privacy resource (e.g. a Cookie Policy) that is not reachable, so the promised information cannot be accessed. Band-setting only on elevated-sensitivity processors under GDPR Art.12 (information easily accessible; facilitate the exercise of rights). Distinct from F1 (no notice), F8 (no rights route), M33 (notice hard to discover) and L1 (the ordinary-site informational version). · Regulator source: UK GDPR Art. 12(1)/(2) (information easily accessible; facilitate exercise of rights) · GDPR Art. 12 · EDPB transparency guidelines · PDPA ss.11-12 (Openness Obligation) · Australia APP 1 · APPI Art. 32 · CCPA notice-at-collection s.1798.100(a)
M37Cookies or similar technologies in use; no information about them foundMedium
What it checks: The live pass observed cookies or tracker requests, no cookie or tracking-technology policy was found, and neither the cookie banner's text nor the privacy notice the scan read mentions cookies or similar technologies (a reviewed term list in 29 languages). A page in a language outside the list, a banner or notice that could not be read in full, or a consent tool whose banner was not seen withholds the finding. Not raised where no privacy notice was found (F1 carries that). Counted on EU, UK, Singapore and Malaysian leads. Where the scan also counts M2, F3, F7, M23 or F1 for the same site, it is shown but not counted a second time. · Regulator source: ePrivacy Art.5(3) · PECR Schedule A1 ¶2 (Consent)
Low-severity findings (L)
F14No breach-response commitment or contact publishedLow
What it checks: No published breach-response commitment or reporting contact. Maturity indicator: not graded as a legal duty. · Regulator source: GDPR Art.33 · Malaysia PDPA s.12B · Thailand PDPA s.37 · LGPD Art.48 & ANPD Res.15/2024 · PIPL Art.57 · nFADP Art.24 · PIPA 72h · Nigeria 72h · Saudi Implementing Regs Art.24 · UAE PDPL Art.9
M7Breach response timeline/contact missing (process exists)Low
What it checks: Breach process exists but lacks timeline/contact. · Regulator source: GDPR Art.33 · Malaysia PDPA s.12B · Thailand PDPA s.37 · LGPD Art.48 & ANPD Res.15/2024 · PIPL Art.57 · nFADP Art.24 · PIPA 72h · Nigeria 72h · Saudi Implementing Regs Art.24 · UAE PDPL Art.9
L1No standalone cookie policy where promisedLow
What it checks: A separate cookie policy is explicitly referenced but none found. · Regulator source: EDPB transparency guidelines
L2Content aimed at children observedLow
What it checks: Children's content without age-gating on a non-child-directed site. · Regulator source: ICO AADC · FTC COPPA · PDPC Children's Guidelines · DPDPA Rule 10 · Brazil ECA Digital · Thailand PDPA s.20
L3Do Not Track explicitly ignoredLow
What it checks: DNT ignored (GPC not separately implicated). · Regulator source: CCPA regs (context)
L4Behavioral advertising without explicit consent disclosureLow
What it checks: Behavioral ads without explicit consent disclosure. · Regulator source: EDPB Guidelines 05/2020 · PECR reg. 6 · EDPB 1/2024
"What it checks" describes the public-surface signal, not internal detector logic. Commendable practices (codes beginning C) are recognized separately and never move the band.
Cross-border sites
When a site reaches users in more than one jurisdiction, each indicator is scored against the most stringent applicable regime. A clean result from one vantage is reported as "not observed from this vantage" — never as "compliant" — because the absence of a finding in one country is not evidence of compliance in another.
When a site limits access
Some sites rate-limit or block automated visitors. When that happens the scanner does not fail silently or invent results: it returns a preliminary, access-limited assessment with an explicit banner, reports only what it could directly observe, and withholds any finding that depends on having fully read the site. You always know what was — and wasn't — established.
The same rule applies to our own failures, and it applies to how we look as well as whether we could. The live pass visits your site over HTTPS. If that connection fails we do not retry over plain HTTP: a response served over a scheme your site refuses is not evidence about your site. Secure cookies are neither sent nor set over plain HTTP, consent platforms and most tracking vendors load over HTTPS only, so such a page would under-report exactly the things this scan exists to observe — and it would under-report them in the flattering direction. We would rather record that we saw nothing than record something we would have to discard.
And when the failure is ours — our network route to your site, not your site's response to us — the report says so in those words. A fault on our side is never presented as a finding about you.
Canonical reference documents
This page is the plain-language summary. The full, citable source documents are published openly: the complete methodology and the regulator reference — every regulator source, statutory instrument and enforcement decision behind the finding catalog.
Scanner methodology (full) ↗ · Regulator reference ↗
Known limitations
10 October 2026. Before 8 October 2026, the scanner did not check the country of the address it used for the live browser visit. Checks since then found that some visits requested from the United States left from addresses in other countries; earlier visits from that location may have done the same. Reports made before that date are shown as they were made.
How the law a report is measured against is chosen: two rules added on 10 October 2026
Reports made from 10 October 2026 follow two rules.
1. The scan’s location must be confirmed. A law is taken from the country a scan was requested from only where the scan confirms its visit came from there: either the network location the visit used was checked at the start and the end of the visit and was in that country (for California, in that state), or the scanner ran from its own servers in that country’s region. Otherwise no law is taken from where the scan ran, and the report shows no overall band.
2. A governing-law clause only supports other evidence. A clause in the operator’s own terms naming the law that governs them, such as “governed by English law”, supports other evidence that a site serves the European Union or the United Kingdom. On its own, it no longer brings in the EU or UK standard.
Each report records the rules it was made under. Reports made before these rules applied, including some made earlier on 10 October, are shown as they were made.
Versioning
The current ratified methodology is Methodology v1.19 (with Regulator Reference v2.0). It incorporates the geo-vantage addendum governing multi-region scans — disclosing the vantage each result was observed from and the rule that absence ≠ compliance. The methodology is versioned and auditable, and findings are reproducible against the published rules.
Automated diagnostic on public information. An indicator, not legal advice, and not a determination of any breach. For material decisions, consult a qualified privacy professional. Methodology v1.19 · Regulator Reference v2.0 · Research preview.