Storage before a consent choice
Records observed storage before a visitor makes a choice. A supported advertising-storage match can produce a failed check; unfamiliar names require review.
What we check.
What it proves.
23 rule types. Three areas. Recorded evidence, clear limits and links to the official rules behind the checks.
Methodology reviewed 1 October 2026 · Independent technical testing, not government approval or legal certification.
We visit like a customer.
The free scan visits up to five public pages. Separate browser sessions help keep an old consent choice from contaminating a fresh test.
01Fresh visit, before a choice02Choose Reject03Reload and observe04Accept in a separate visit
We record supported interactions, storage, external requests and available page evidence. Time limits, blocked pages and unfamiliar interfaces can restrict what is observed. We do not log in, buy products or send messages through forms or chatbots.
Cookies & tracking
Ten rule types examine visible controls and supported browser behaviour. Purpose and exceptions still matter.
Relevant legal framework
UK: PECR regulation 6. EU: national rules implementing ePrivacy Article 5(3), alongside relevant GDPR consent requirements. Country-specific exceptions are not exhaustively tested.
Behaviour after Reject
Attempts a supported Reject control and inspects the resulting storage activity. An unsupported or incomplete interaction is not counted as a pass.
Meaningful reject option
Looks for a recognisable Reject or Necessary Only option. Failure to locate it automatically creates a warning, not proof that the option is absent.
Ease of refusing consent
Checks whether Accept and Reject are visible and supported interactions complete. Colour, prominence, wording and real usability still need visual review.
Preselected non-essential categories
The current scanner does not verify the default state of every granular preference category. A suitable preference-panel test needs manual review.
Consent withdrawal mechanism
Looks for a cookie-settings or consent link. It does not complete an end-to-end withdrawal test, so a visible link is not a verified withdrawal pass.
Policy and technology comparison
Lists recognised technologies for comparison with policy wording. It does not certify the accuracy of purposes, providers or retention periods.
Embedded third-party content
Records frames present before consent. An iframe or external request alone does not establish unlawful tracking.
Reject behaviour after reload
Checks observed storage after rejection and reload. A supported failure needs recorded evidence; a blocked or failed reload remains untested.
Consent choice persistence
Looks at the consent interface after reload. Its disappearance alone does not prove that preferences persist correctly across all visits.
Privacy complaints
Seven rule types distinguish a public contact route from the internal process that has to follow it.
Relevant legal framework
UK: Data Protection Act 2018, section 164A, as inserted by the Data (Use and Access) Act 2025. This specific UK complaints duty must not be presented as an identical EU-wide rule.
Privacy contact discoverability
Looks for contact details on discovered privacy-related pages. It does not establish who reads the inbox or their responsibilities.
Public data-protection complaint route
Looks for privacy-complaint wording and an electronic contact route. It never sends a test complaint.
Complaint information discoverability
Checks the discoverability of complaint information within the pages reached. A route elsewhere on the site may be missed.
Acknowledgement within 30 days
Public browsing cannot verify acknowledgement within 30 days. Any owner answer is self-reported, not observed proof.
Complaint investigation process
The scanner cannot inspect your internal investigation process. A responsible person must confirm the arrangements.
Outcome communication
Public checks cannot establish whether you communicate complaint outcomes. This needs an operational review.
Electronic complaint mechanism
Identifies visible electronic contact alongside privacy-complaint wording. Message delivery and handling are not tested.
AI transparency
Six rule types flag visible signals and questions for investigation. This is not an automated AI compliance audit.
Relevant legal framework
EU AI Act: Articles 2 and 50. Territorial scope, the type of system and provider/deployer roles determine which duties apply. Personal-data processing also needs a separate GDPR assessment.
AI or chat technology detected
Looks for chat vendors and visible AI references. A widget can be human-operated or scripted, and no detected signal does not prove no AI is used.
Disclosure at first interaction
Records visible AI wording. The scanner does not open or message the widget, so first-interaction timing and adequacy require review.
Human identity and AI disclosure
Whether an interface misleadingly presents AI as a person requires contextual assessment. No conclusion is inferred from the vendor name.
AI processing in privacy information
Looks for AI or chatbot references in discovered privacy information. Actual processing, completeness and accuracy require confirmation.
EU applicability assessment
Actual functionality, EU scope and provider/deployer responsibilities need assessment. A UK address alone does not establish applicability.
Public-interest publishing workflow
The scan cannot identify every synthetic item or verify public-interest editorial workflows. It does not certify deepfake or AI-content compliance.
How your score works
The score summarises assessed rule types, not the percentage of GDPR laws you comply with. Repeated checks across pages count once, using the least reassuring assessed result.
Passed: 100 pointsWarning: 70 pointsMedium failure: 40 pointsHigh failure: 0 pointsUntested: excluded
We average the assessed points. If any rule fails, the total is capped at 59 and labelled “Needs fixing”, so other passes cannot hide the failure. With no failures, 85–100 is “Good” and 65–84 is “Fair”. A scan with no assessed rules has no numerical score. Coverage is shown separately.
Example: seven passed rules and six warnings produce 86/100. That is a useful starting point, not a compliance certificate. Report counts can include repeated page findings, so they may differ from the distinct rule count used for the score.
What remains outside the scan?
Private account areas, server-side processing, full fingerprinting coverage, all storage mechanisms, every national exception, actual retention practices, international-transfer contracts, security posture and internal complaint handling are not conclusively tested. A privacy-policy link does not prove the policy is accurate.
Our paid service adds manual investigation and agreed technical fixes. The scope is confirmed before payment; it does not guarantee every aspect of legal compliance.
Full testing limitations →