Skip to main content
Book

Transparency page

How the score is built

Every criterion, weight, detection signal, and limitation — published so the score can be checked, challenged, and reproduced. The same heuristics run server-side (URL mode) and in your browser (paste-HTML mode).

Scoring criteria (v1.0)

Each category is scored independently, then summed to a 0–100 total and graded A (90+) · B (80+) · C (70+) · D (60+) · F (below 60). Within a category, ≥80% of points is a pass, 40–79% a warning, below 40% a fail.

  1. 01Banner presence

    25 / 100

    Pass (25) if a banner-like element or banner copy is found in the page markup; fail (0) otherwise.

    Detection signals

    • id / class attributes matching cookie/consent + banner, notice, bar, popup, modal, dialog, wall (English and French spellings)
    • Visible copy such as “we use cookies”, “accept cookies”, “nous utilisons des cookies/témoins”

  2. 02Consent platform (CMP)

    20 / 100

    20 for a recognized CMP vendor; 12 for IAB TCF signals alone; 8 for a banner with neither (likely custom code); 0 for nothing.

    Detection signals

    • Vendor signatures: OneTrust, Cookiebot, Didomi, TrustArc, Osano, Quantcast Choice, CookieYes, Complianz, Usercentrics, Termly, CookiePro, Securiti, Clym, Transcend, Ketch, Iubenda
    • IAB Transparency & Consent Framework markers: __tcfapi, __tcfapiLocator, IABTCF_*, euconsent

  3. 03Consent model quality

    20 / 100

    7 for a one-click reject-all; 7 for granular purpose/settings controls; 3 for no pre-ticked checkboxes; 3 for no browsewrap language.

    Detection signals

    • “Reject all / refuse all / refuser tout” options
    • “Manage preferences / personnaliser / gérer les préférences” controls
    • Checked checkbox inputs in markup (pre-ticked = penalty)
    • “By continuing to use this site…” / “en poursuivant votre navigation…” (browsewrap = penalty)

  4. 04Pre-consent loading

    25 / 100

    25 if no common trackers are found; otherwise 25 × (gated trackers ÷ detected trackers), rounded.

    Detection signals

    • Trackers: GA4, Universal Analytics, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity, LinkedIn Insight, TikTok Pixel, Pinterest Tag, Google Ads
    • Gating markers: data-cookieconsent / data-consent / data-category attributes, text/plain script blocking, CMP category classes

  5. 05Policy links

    10 / 100

    10 for a cookie-policy link; 6 for a privacy-policy link only; 0 for neither.

    Detection signals

    • Link hrefs/text matching cookie-policy / politique de cookies-témoins
    • Fallback: privacy-policy / politique de confidentialité links

How URL fetching works

Entering a URL asks the site's server to fetch the page. These are the safeguards around that fetch:

  • SSRF hardening

    Only http/https URLs, max 2,048 characters, no embedded credentials. Private, loopback, link-local (including cloud metadata IPs), multicast, and reserved ranges are blocked — for IP literals directly, and for hostnames after DNS resolution, on the initial URL and after every redirect.

  • Redirects

    Up to 3 redirects followed manually; each target is re-validated with the same rules before fetching.

  • Timeouts and caps

    8-second fetch timeout, ~2 MB body cap, text/HTML-ish documents only. Nothing is executed.

  • Rate limiting

    10 audits per minute per IP; the badge endpoint is limited separately.

  • Retention

    Fetched HTML is analyzed in memory and not stored. Paste-HTML mode never leaves your browser at all.

What the score cannot prove

  • Static markup only

    The auditor reads the HTML as served. It cannot observe what scripts do at runtime, whether consent choices are actually honored, whether consent records are kept, or whether a banner is shown only to visitors in certain regions (geo-targeting). A site can score well here and still mishandle consent in practice — and vice versa.

  • Vendor match ≠ correct configuration

    Finding OneTrust or Cookiebot code means the vendor's script is present, not that purposes, vendors, legitimate-interest claims, or the TCF string are configured correctly. Configuration review is a separate, human job.

  • Gating is inferred

    Whether a tracker is “gated behind consent” is inferred from script attributes in the HTML. Scripts injected dynamically after page load, or loaded through tag managers with their own consent logic, may behave differently from what the markup suggests.

  • Banners vary by visitor

    Many sites show different banners (or none) based on geography, prior consent cookies, or A/B tests. A single fetch sees a single variant.

  • Not legal advice

    This tool is an educational heuristic. It is not a legal opinion, not a compliance audit, and not a substitute for review by qualified counsel. Law 25, PIPEDA, the GDPR, and ePrivacy each turn on facts — actual practices, records, contracts — that no automated markup check can assess.

Not legal advice.This tool is an educational heuristic. Compliance turns on actual practices, records, and contracts — things no automated markup check can assess. For anything that matters, get qualified counsel.

Reproducibility

The heuristics are deterministic: the same HTML always produces the same score. Paste-HTML mode lets anyone re-run an audit locally and compare. Scores are point-in-time — sites change, CMPs get reconfigured, and a badge earned in September says nothing about December.

Version history: v1.0 (2026-09-19) — initial release; five categories, EN/FR signals, server + client modes.