Scoring methodology
How we calculate the score
The score starts at 100 and each rule the website breaks deducts points by severity. Each rule counts once, even if the website breaks it in several places.
| Severity | Deduction |
|---|---|
| critical | 30 points, all critical together at most 60 |
| high | 15 points |
| medium | 7 points |
| low | 3 points |
| informational | 0 points |
- The score never drops below 0. Informational rules do not change the score; the report lists them as observations.
- Tracking after rejection (R-003) and cookies after rejection (R-004) are assessed separately, so one behaviour of a website can cost up to 45 points.
- Rules the customer marked as wrong in the dashboard do not count towards the score; the report states how many there are.
- A scan the website blocked (bot protection or refusing the automated browser) is not evaluated: it has no score and no findings.
Bands
- Good: score 80 or more and no open critical or high finding.
- Needs improvement: score 50 to 79, or 80 or more with an open high finding.
- Serious shortcomings: score below 50, or any open critical finding.
- An open finding is a finding of the scan that the customer has not marked as wrong.
Examples
- Cookies after rejection (R-004), nothing else: 100 − 15 = 85 points. Band Needs improvement: the score is above 80, but a high finding is open.
- Tracking and cookies after rejection (R-003 and R-004): 100 − 30 − 15 = 55 points. Band Serious shortcomings, because R-003 is a critical finding.
- The policy does not mention two cookies (R-030) and cookies live too long (R-011): 100 − 7 − 7 = 86 points. Band Good: both findings are medium.
- Three critical findings: 100 − 60 = 40 points (critical cap). With two more high ones (R-004 and R-027): 40 − 15 − 15 = 10 points. Fixing one of the three critical findings does not change the score ("+0 points, critical cap"); the score starts to rise once two or fewer remain.
The score is a technical measurement of how the website behaves, not a measure of GDPR compliance.
Rules
Each rule has a stable ID; the report gives the ID, severity and evidence of every finding. One sentence says what the rule means.
Consent before processing
| ID | Rule | Severity | What it means |
|---|---|---|---|
| R-001 | Tracker before consent | critical | An analytics or marketing tool measures the visitor before they decide; cookieless pings are covered by R-027. |
| R-002 | Cookie before consent | critical | The website stores an analytics or marketing cookie before the visitor consents. |
| R-015 | Identifier in storage before consent | high | The website stores a tracking identifier in browser storage before the visitor consents. |
| R-020 | No banner although the site tracks | critical | The website tracks visitors and offers no consent choice. |
| R-027 | Google consent mode pings without consent | high | Before consent or after rejection, cookieless pings go to Google. |
Respecting the rejection
| ID | Rule | Severity | What it means |
|---|---|---|---|
| R-003 | Tracker after rejection | critical | After "Reject" the website keeps measuring the visitor. |
| R-004 | Cookie after rejection | high | After "Reject" analytics or marketing cookies stay or appear. |
| R-006 | Rejection not persisted | medium | After rejecting and reloading the page, the banner shows again. |
| R-041 | Tracker after rejection on a subpage | high | The rejection holds on the home page, but a subpage measures the visitor again. |
Banner design
| ID | Rule | Severity | What it means |
|---|---|---|---|
| R-005 | Reject missing on the first layer | high | The banner offers "Accept" at once; rejecting takes a further step. |
| R-007 | Pre-ticked categories | high | Optional categories are switched on in advance in the banner settings. |
| R-008 | Reject less prominent | medium | The reject button is smaller or less visible than the accept button. |
| R-009 | Consent by continuing to browse | high | The website treats scrolling or carrying on as consent. |
| R-010 | No way to change consent | medium | After consenting, the page has no link to change the choice. |
| R-055 | The banner needs a manual check | informational | The scan could not classify some banner buttons; they need a manual check. |
External resources and data transfers
| ID | Rule | Severity | What it means |
|---|---|---|---|
| R-018 | External fonts before consent | medium | Fonts load from a third party, which receives the visitor's IP address. |
| R-019 | Embedded media or maps before consent or after a rejection | high | A third-party video, map or social media widget loads before the visitor consents, or even after a rejection. |
| R-021 | Captcha loaded before consent | medium | A third-party form protection loads as soon as the page opens. |
| R-022 | Chat widget before consent | high | A third-party chat loads before the visitor consents. |
| R-023 | Libraries from third-party CDNs | low | The website loads libraries from third-party servers. |
| R-024 | Data transfer outside the EU | informational | An overview of services whose provider is based or transfers data outside the EU. |
Technical hygiene and transparency
| ID | Rule | Severity | What it means |
|---|---|---|---|
| R-011 | Excessive cookie lifetime | medium | A non-essential cookie lasts longer than 13 months. |
| R-012 | Cookies without the Secure flag | low | A cookie on a secure page lacks the Secure flag. |
| R-013 | Cookies without SameSite | low | A cookie lacks the SameSite attribute. |
| R-014 | Unknown cookies | informational | A cookie whose purpose could not be determined. |
| R-016 | Third-party cookies from an unknown provider | informational | A third-party cookie whose provider we do not know. |
| R-017 | Cookie policy link missing | medium | Neither the page nor the banner links to the policy. |
| R-030 | The policy does not mention some cookies or services | medium | The policy does not mention cookies or services the website uses. |
| R-034 | New tracker since the last scan | informational | A tracker appeared since the previous scan. |
| R-025 | Missing security headers | low | The server does not send basic security headers. |
| R-026 | HTTP not redirected or mixed content | medium | The website does not redirect to HTTPS or loads insecure content on a secure page. |
What the scan does
- The scan opens the given page in a clean browser and runs four scenarios, each in a new browser with no stored data: No interaction (the visitor clicks nothing), Scroll without a click, Accept all and Reject all.
- For "Reject all" the scan really clicks the banner's button and then reloads the page. It checks whether tracking stopped or only the banner disappeared.
- In the dashboard the customer chooses desktop, mobile or both; each device has its own scan and its own score. The free test scans the given page on desktop.
- If the customer lists subpages of a website in the dashboard, after the rejection the scan visits them too and checks that the rejection holds across the website (R-041).
- The scan reads the policy the website links to and looks for the cookies and services it found. The scan does not assess whether the policy is complete or correct; it only checks that the policy lists what the website uses.
- A scheduled scan compares the result with the previous scan of the same device and flags new trackers (R-034).
What the scan does not see or score
- subpages other than the ones given, logged-in areas and content behind a login or a payment;
- what the website does with data on the server after receiving it, including server-side measurement that does not show in the browser;
- processor agreements, standard contractual clauses (SCC) and the controller's transfer impact assessment (TIA);
- whether and how records of consent are kept;
- how the website behaves for visitors from other countries, with other browser settings or after longer use;
- parts of the website protected against automated browsers (such a scan is not evaluated);
- what happens to data after a form is submitted and in other channels (e-mail, mobile app).
- Informational rules (R-014, R-016, R-024, R-034, R-055) do not change the score.
- A tracker our database does not know is not counted as tracking: "tracking after rejection: 0" means that none of the tools we know measured after the rejection.
- The scan gives no legal verdict. The report is a technical audit of how the website behaves, not legal advice.
- The score is a technical measurement of how the website behaves, not an assessment of GDPR compliance.
The "Cookie consent verified" badge
- The badge is verified when the newest scan of every monitored device was evaluated (not blocked), is at most 14 days old and has no critical or high finding.
- If any condition fails, the badge shows "not verified" until a later scan meets them.
- The badge is a public claim, so marking a finding as wrong in the dashboard does not affect it.
- A change of the badge applies as soon as the scan finishes; the owner and the website's alert recipients get an e-mail about it at that moment.
How to dispute a finding
- If you think a finding is wrong, report it in the website's detail with "Report a wrong finding". We review it and tell you by e-mail whether we fixed the mistake or the finding stands.
- You can also mark a finding as wrong in the dashboard: the rule then no longer counts towards the score, but the badge still takes it into account. We fix a mistake of the scanner in the rules or the database only when you report it.
Methodology version and changelog
Every report states in its metadata the methodology version it was evaluated by. The version goes up with every change of the rules, weights, cap or bands; a change of the tracker database does not change it (the database has its own version in the report).
Older scans are not recalculated: each report keeps the version it was evaluated by, and new scans use the new version.
| Version | Date | Change |
|---|---|---|
| 1 | 12 Nov 2026 | Methodology published; band by the severity of open findings; critical cap of 60 points; marked rules left out of the score. |
| 2 | 13 Nov 2026 | R-019 also rates embedded media and maps after a rejection; social media widgets added to the database. |
Glossary
Service: the provider according to our database (for example Google or Meta), otherwise the domain the website talks to. One provider counts once, even if it uses several domains.
Tracking service: a service our database classifies as analytics or marketing. Unclassified domains do not count as tracking.
Tracker: a known kind of request of a provider (for example audience measurement or an advertising pixel). One service can have several trackers.
Provider, service, domain, tool: The domain is the server's address, the provider is the company that runs it; a service = one provider (counted once); a tool (tracker) = a specific measurement or pixel of a provider, and the finding lists them by name. A known tracking tool the website loads through its own domain counts too.
Cookieless pings: Google consent mode in the denied state; a separate high finding, R-027. They are not counted in "tracking after rejection" (R-003 and the metric); the report lists them separately.
Open finding: a finding of the latest scan that the customer has not marked as wrong.