Transparency page
How the score is built
Every criterion, weight, detection signal, and limitation: published so the score can be checked, challenged, and reproduced. The same heuristics run server-side (URL mode) and in your browser (paste-HTML mode).
Scoring criteria (v1.0)
Each category is scored independently, then summed to a 0–100 total and graded A (90+) · B (80+) · C (70+) · D (60+) · F (below 60). Within a category, ≥80% of points is a pass, 40–79% a warning, below 40% a fail.
01Banner presence
25 / 100Pass (25) if a banner-like element or banner copy is found in the page markup; fail (0) otherwise.
Detection signals
- id / class attributes matching cookie/consent + banner, notice, bar, popup, modal, dialog, wall (English and French spellings)
- Visible copy such as “we use cookies”, “accept cookies”, “nous utilisons des cookies/témoins”
02Consent platform (CMP)
20 / 10020 for a recognized CMP vendor; 12 for IAB TCF signals alone; 8 for a banner with neither (likely custom code); 0 for nothing.
Detection signals
- Vendor signatures: OneTrust, Cookiebot, Didomi, TrustArc, Osano, Quantcast Choice, CookieYes, Complianz, Usercentrics, Termly, CookiePro, Securiti, Clym, Transcend, Ketch, Iubenda
- IAB Transparency & Consent Framework markers: __tcfapi, __tcfapiLocator, IABTCF_*, euconsent
03Consent model quality
20 / 1007 for a one-click reject-all; 7 for granular purpose/settings controls; 3 for no pre-ticked checkboxes; 3 for no browsewrap language.
Detection signals
- “Reject all / refuse all / refuser tout” options
- “Manage preferences / personnaliser / gérer les préférences” controls
- Checked checkbox inputs in markup (pre-ticked = penalty)
- “By continuing to use this site…” / “en poursuivant votre navigation…” (browsewrap = penalty)
04Pre-consent loading
25 / 10025 if no common trackers are found; otherwise 25 × (gated trackers ÷ detected trackers), rounded.
Detection signals
- Trackers: GA4, Universal Analytics, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity, LinkedIn Insight, TikTok Pixel, Pinterest Tag, Google Ads
- Gating markers: data-cookieconsent / data-consent / data-category attributes, text/plain script blocking, CMP category classes
05Policy links
10 / 10010 for a cookie-policy link; 6 for a privacy-policy link only; 0 for neither.
Detection signals
- Link hrefs/text matching cookie-policy / politique de cookies-témoins
- Fallback: privacy-policy / politique de confidentialité links
How Declared vs Observed works (v2)
The markup score above is the declared check: what a page says about itself. Declared vs Observed adds the runtime side. You import a HAR file or a cookie export recorded in your own browser, and paste the cookie declaration from your consent platform. The comparison runs entirely in your browser. No endpoint fetches, crawls, or proxies anything for this part of the tool.
Each observed cookie is classified on two axes. The technical party is the domain that set it. The legal party is the organisation that receives and uses the data, taken from a bundled vendor cookie knowledge base (version shown in the tool, reviewed on the date shown there). The two differ often: analytics and advertising cookies set on your own domain by a vendor script are first-party by domain and third-party by recipient. A first-party subdomain that resolves through a CNAME record to a vendor is classified to that vendor. Unknown cookies are reported as unknown, never guessed.
The diff produces three buckets: observed but not declared, declared and observed, and declared but not observed. The register export uses the 19-column schema published in the Cookie & Script Governance Field Guide, so the output drops straight into a governance register with owner, decision, and review-date columns waiting to be filled in.
Import safeguards, by design: files are capped at 10 MB, pasted text at 2 MB, and imports at 5,000 items. Parsing is strict JSON with a safe failure, imported names are rendered as text only, and raw cookie values are discarded during parsing, before anything is displayed or exported. CSV exports escape spreadsheet formula injection. The only optional storage is a per-site summary of names, domains, and counts in your browser's local storage, with a one-click wipe, and the analysis itself makes no network requests.
How URL fetching works
Entering a URL asks the site's server to fetch the page. These are the safeguards around that fetch:
SSRF hardening
Only http/https URLs, max 2,048 characters, no embedded credentials. Private, loopback, link-local (including cloud metadata IPs), multicast, and reserved ranges are blocked: for IP literals directly, and for hostnames after DNS resolution, on the initial URL and after every redirect.
Redirects
Up to 3 redirects followed manually; each target is re-validated with the same rules before fetching.
Timeouts and caps
8-second fetch timeout, ~5 MB body cap, text/HTML-ish documents only. Nothing is executed.
Rate limiting
10 audits per minute per IP; the badge endpoint is limited separately.
Retention
Fetched HTML is analyzed in memory and not stored. Paste-HTML mode never leaves your browser at all.
What the score cannot prove
Static markup only
The auditor reads the HTML as served. It cannot observe what scripts do at runtime, whether consent choices are actually honored, whether consent records are kept, or whether a banner is shown only to visitors in certain regions (geo-targeting). A site can score well here and still mishandle consent in practice, and vice versa.
Declared vs Observed sees one browser, one visit
The Observed diff works from a HAR file or cookie export you supply: one browser profile, one set of pages, one consent state at a time. Cookies set only after events (checkout, form submit, video play), only in some regions, or only for logged-in users appear only if your import captured them. Server-side data sharing leaves no trace in a HAR file at all. Treat a clean diff as evidence about the sessions you captured, not about every session.
Vendor match ≠ correct configuration
Finding OneTrust or Cookiebot code means the vendor's script is present, not that purposes, vendors, legitimate-interest claims, or the TCF string are configured correctly. Configuration review is a separate, human job.
Gating is inferred
Whether a tracker is “gated behind consent” is inferred from script attributes in the HTML. Scripts injected dynamically after page load, or loaded through tag managers with their own consent logic, may behave differently from what the markup suggests.
Banners vary by visitor
Many sites show different banners (or none) based on geography, prior consent cookies, or A/B tests. A single fetch sees a single variant.
Not legal advice
This tool is an educational heuristic. It is not a legal opinion, not a compliance audit, and not a substitute for review by qualified counsel. Law 25, PIPEDA, the GDPR, and ePrivacy each turn on facts (actual practices, records, contracts) that no automated markup check can assess.
Reproducibility
The heuristics are deterministic: the same HTML always produces the same score. Paste-HTML mode lets anyone re-run an audit locally and compare. Scores are point-in-time: sites change, CMPs get reconfigured, and a badge earned in September says nothing about December.
Version history: v1.0 (2026-09-19): initial release; five categories, EN/FR signals, server + client modes.