How we measure

Every scan runs in headless Chrome on our server in a San Francisco data center, with a US time zone and US English. Many sites show different consent banners depending on the visitor’s country — scanning from Europe would measure what European visitors see. The report states where and when each scan ran.

The browser identifies itself as an ordinary Chrome, without a scanner label in the user agent, so the report shows what visitors see.

1. 1

   Paired runs with and without Global Privacy Control

   We load your home page in pairs: one browser without the signal, one with it (the Sec-GPC header and navigator.globalPrivacyControl). By default there are three pairs. We compare whole services, not request counts — request counts vary on their own. A service counts as switched off only if it appeared in most runs without the signal and in none with it.

2. 2

   Reject click and reload

   In a fresh browser we find the banner’s reject choice, click it, reload the page and record every third-party host and cookie that still appears. We also compare how accept and reject are presented.

3. 3

   Opt-out link and form

   We look for the “Do Not Sell or Share” link and its permitted variants, follow it, and read the page or form behind it — including forms embedded from another site — for what it asks of the visitor.

4. 4

   Privacy policy text

   We open the linked privacy policy and search its text for the elements 11 CCR § 7011 requires, using patterns. In full reports, an AI model also reads the policy; its finding counts only if the passage it quotes is in the text, and for some elements only if the pattern agrees.

5. 5

   CIPA risk indicators

   We note services that receive what visitors type into forms or search, session recording tools, and third-party chat widgets. These are indicators of litigation risk, never findings of a violation.

• Text analysis is a search for wording. A policy can cover a point in words we do not recognize, or use words we match without meaning what we expect.
• Some sites block data-center traffic with bot protection. When a scan is blocked, we say so and produce no report from the block page. The site owner can let the scanner through with a secret header or an IP allowlist (Settings → Scanner access). We do not disguise the scanner to get past protection.
• Banners and tags can depend on location. We measure from one US location; visitors elsewhere may see something else.
• A scan is one point in time. Tags, consent tools and policies change — which is why monitoring scans again.
• Whether the CCPA applies depends on revenue and data volume, which no scan can see. Until you tell us, findings read “applies if thresholds are met”.
• We see the browser side only: what loads, what is sent, what the page says. Contracts, server-side data flows and how requests are handled internally are outside the scan.

Each finding has two parts. “What we observed” is the measurement, for example: the signal was sent and these services still loaded. “What it means” is a conclusion that depends on conditions, such as the CCPA thresholds or the kind of service. We never present one as the other.

An automated first assessment of what we observed from a US location on a given date. It is not legal advice and does not declare a site to conform to any law. Ask an attorney licensed in California how the findings apply to your business.