What we check
Every rule in the scan produces one finding. A finding has a category, a severity, a status, a title, a legal citation, a remediation note, and the raw evidence it was decided on. This page explains the vocabulary so a report can be read without guesswork.
Categories
There are seven categories. Each maps to a question a regulator or a court has already had to answer.
| Category | The question it answers | Example checks and citations |
|---|---|---|
| Banner | Is a consent mechanism present, and does it start from an unticked state? | "Not preticked" (GDPR Art. 4(11)); banner present (GDPR Art. 4(11), Art. 6(1)(a)) |
| Pre-consent | What was stored or read on the device before the visitor chose anything? | "No nonessential cookies" (ePrivacy Directive 2002/58/EC Art. 5(3); GDPR Art. 6(1)(a)); "No thirdparty trackers" (ePrivacy Art. 5(3)) |
| Reject | Is refusing as easy as accepting, and does refusing actually stop tracking? | "As easy as accept" and "Stops tracking" (GDPR Art. 7(3)) |
| Granularity | Can the visitor choose per purpose, using controls that actually work? | "Purpose choices" (GDPR Art. 4(11), Art. 7(4), Art. 21) |
| Privacy policy | Can a visitor find the policy from the page they landed on? | "Discoverable" (GDPR Art. 6(1)(a)) |
| Dark patterns | Does the banner's design steer the visitor towards accepting? | "Asymmetric buttons" and "Label length asymmetry" (EDPB Guidelines 03/2022; CNIL Deliberation 2020-091; GDPR Art. 7(3)) |
| Fingerprinting | Are browser APIs commonly used to identify a device being called? | Fingerprinting detection (ePrivacy Art. 5(3); EDPB Guidelines 8/2020) |
Severity
Severity describes how much a check matters, not how badly it went. It is fixed per rule and does not change with the result.
The five levels, with a real check at each of the top three:
- Critical: for example "No thirdparty trackers" before consent (ePrivacy Directive 2002/58/EC Art. 5(3)) or "Stops tracking" under reject (GDPR Art. 7(3)).
- High: for example "Not preticked" (GDPR Art. 4(11)).
- Medium: for example "Purpose choices" under granularity (GDPR Art. 4(11), Art. 7(4), Art. 21).
- Low and Info: the remaining rules in the set.
A passing finding still carries its severity, so the level tells you how much a rule matters, not how the site did on it.
Status
Status is the result of the check on this particular page.
- Pass: the observation met the rule.
- Warn: the observation partly met the rule, or met it in a way that deserves a closer look.
- Fail: the observation did not meet the rule.
- Not applicable: the rule does not apply to this page, for example a granularity check on a banner with no purpose controls.
- Inconclusive: the scan could not gather enough evidence to decide.
On the report, findings with status fail are listed under "Issues to fix" and findings with status warn under "Warnings". Passing and not applicable findings are collapsed but still present, so the full picture can be reviewed.
What every finding carries
Each finding card shows the status, severity and category, a title, a remediation note describing what to change, the legal citation the rule is based on, and an expandable block with the raw evidence. The evidence is the actual observation from the browser: the cookie names, the request domains, the DOM selectors that matched, the button labels. It is there so the finding can be verified independently rather than taken on trust.
How findings become a score
Each rule has a weight. The report's score, from 0 to 100, is computed from the weighted results of the checks. The rules version that produced the score is printed on the report, so a change in score between two scans can be attributed either to the site or to the rule set. See Reading your report for where each of these elements appears on the page.
Automated compliance indicators, not legal advice.