A baseline for comparison
The Accept Path provides a score-neutral baseline for consent-dependent activity. The click itself does not establish that consent was registered; a verified state transition is a separate observation.
Contact
Open navigation menu
The CertScore.ai methodology
Real browser behavior.
Evidence you can review.
What loads before consent? What happens after Reject? See cookies, services, privacy signals, and supporting evidence together in one browser-based website report.
Each finding describes evidence observed during a visit to a public website. Read it with the report's scan time, region, and coverage; it is a point-in-time observation, not a legal determination or certification.
See the methodology in action. Start a free scan.
Loading scan form…
No credit card required. Public websites only. Existing scan allowances apply.
From website to evidence
- 01
Observe
Visit a public website in an instrumented browser under defined test conditions.
- 02
Retain
Capture technical evidence with timestamps, location, and observation context.
- 03
Review
Explore supported findings and their evidence in a report your team can inspect.
Inside your report
See the detail. Find your next step.
01 / 07
Know where to look first.
Start with the signal snapshot, inventory, and priority review. Follow a finding back to the retained evidence that supports it.
A clear starting point for your next privacy review.
Explore the report
Coverage depends on the page, available controls, and retained evidence. Unavailable or inconclusive observations remain explicit.
What we measure
One visit. A detailed view of your website.
Each scan captures observable technical signals under defined conditions. Every result belongs to that visit and its coverage.
CMP detection
Identify observed consent-management platforms and the consent interface presented during the visit.
Consent controls
Inspect first-layer Accept, Reject, and Options visibility, with explicit limits when inspection is incomplete.
After Accept & Reject
Review requests and storage after eligible actions, when available. Click completion and consent confirmation remain separate.
Cookies & browser storage
Inspect retained cookies and storage, their purposes, ownership, and when they first appeared.
Services & network requests
Explore vendors, service relationships, request destinations, and observed activity before consent.
Global Privacy Control
Review the GPC observation path, verified signal delivery, and supported comparisons with the passive baseline.
TLS & transport security
Check retained HTTPS, SSL/TLS certificate, redirect, mixed-content, and form-transport observations.
Forms & fields
Review form types, field labels, required states, and checkboxes. View masked form captures when available.
Hidden outbound links
Inspect retained links hidden by off-screen or zero-size styling, their destinations, and affected pages. Human review establishes context.
Policies & disclosures
Review discovered privacy and cookie-policy surfaces, supported transparency observations, and retained excerpts where available.
Embeds & tracking techniques
Review embedded frames and services, plus supported session-replay and fingerprinting signals.
Timing & geographic context
Follow the page event timeline and review scan location, coverage, and timing to interpret each observation.
Share the evidence
Use report sharing and evidence exports to give your team a concrete starting point.
Explore a sample report →Expand your review
Explore full-site scanning and monitoring within your plan’s access and crawl limits.
Compare plans →Bring it into your workflow
API, MCP, and browser-extension options support additional workflows. Start your free website scan here.
Explore integrations →Separate sessions. Distinct observations.
What happens after Accept or Reject?
Eligible controls are observed in separate, clean browser sessions. A completed click, a completed observation, and a confirmed consent decision remain separate facts.
Evidence after a verified refusal
The confirmed-refusal path requires an independently verified refusal-state transition and qualifying activity anchored after it. Requests already in flight at confirmation are excluded.
Reject-click tracking is a separate review signal
A completed authorized Reject click with directly observed, verified analytics, advertising, or session-replay requests may support a Reject-click tracking review signal even when registration is unverified. An unchanged stored cookie alone does not prove active tracking.
Unsupported, ambiguous, incomplete, stale, timed-out, or unverifiable interactions remain limited coverage. Missing evidence cannot become a clean result or a finding.
Evidence & scope
Understand the finding.
Know its limits.
Findings are tied to retained observations. A score summarizes supported findings; it does not replace the evidence behind them.
CertScore is not a certification service. It records website behavior and evidence for review, not legal compliance determinations.
Retained context
Evidence may include cookies, network and runtime records, tracker or vendor observations, consent interfaces, policy surfaces, timestamps, and geographic context, so reported findings can be reviewed and audited.
Geographic measurement
Websites may return different content, consent interfaces, cookies, or third-party activity by location. CertScore can observe the same website from different locations while keeping its core measurement approach consistent.
Validation and repeatability
The measurement approach is evaluated through defined manual-validation studies and repeated browser observations. Each study describes its own sample and conditions, rather than a universal accuracy claim.
Technical observations, bounded conclusions
CertScore measures observable technical states and runtime outcomes for privacy engineering and assurance. Legal compliance, processing purpose, and operator intent may require additional context.
Read an annotated retained report →The measurement glossary
Clear terms. Shared understanding.
- Pre-consent cookie
- A cookie observed before the scanner records a visitor consent choice.
- Tracker detection
- A grouped technology observation supported by browser, network, cookie, storage, script, or related runtime evidence.
- Advertising & Measurement
- A functional category for technologies associated with advertising, advertising measurement, or audience measurement.
- CMP observation
- Evidence that a consent-management platform or consent interface was present during the tested visit.
- Policy surface
- A public page or document that presents privacy, cookie, consent, or related disclosure information.
- Confirmed consent decision
- Evidence, separate from a click, that Accept registered a grant or Reject registered a refusal. Required for confirmed post-refusal findings; separately verified Reject-click tracking can support review without confirmed registration.
- Confirmed clean
- No qualifying activity was retained during a completed observation window. A bounded statement about one observation, not a general claim about the site.
- Limited coverage
- An observation that was unavailable, unsupported, unsuccessful, stale, timed out, or unverifiable. It is explicit, score-neutral, and never equivalent to a clean result.
- Score-neutral comparison
- Evidence retained for interpretation rather than scoring, including the Accept Path baseline, unchanged stored values on their own, and every limited-coverage state.
See what your website reveals.
Start with a free scan. Review the observations and their evidence.