Loading report

CertScore.ai report

Loading report

The report is ready; we’re loading its retained findings and evidence.

ergoveritas.com tracking, cookie, consent, and accessibility scan | CertScore.ai

CertScore.ai

Scanned from California

Oct 26, 2026, 7:03:55 PM UTC(7 sec scan)

Coverage

Scan scope: Single page
Pages scanned: 1
Scan region: California

Timing

Observation window: 7 sec

scan_id

c4c071c6-9313-40b3-94de-23d50d24ba18

Started: Oct 26, 2026, 7:03:55 PM UTC
Completed: Oct 26, 2026, 7:04:02 PM UTC

ergoveritas.com

https://ergoveritas.com/test1.html

Executive overview

53/ 100

3 top issues

1 page scanned

Assessment highlights

“GPC choice-enforcement risk observed”: With Global Privacy Control (GPC) on, advertising identity, audience or sync activity was first observed for Google, Meta and Microsoft about 1.0 seconds into the visit. Other findings: “Hidden outbound links” and “Semantic labeling accessibility issue and other accessibility checks”. Check that GPC sets the sale/sharing opt-out and controls advertising collection.

Regulatory Risk Review · CCPA/CPRA & accessibility

Findings and review items on this page

3 issues

01GPC choice-enforcement risk observedStarting pageAdvertising identity, audience or synchronization activity with GPC enabled: Google LLC (first observed +982 ms from GPC visit start); Meta Platforms, Inc. (first observed +985 ms from GPC visit start); Microsoft Corporation (first observed +987 ms from GPC visit start). GPC delivery was verified on the page request and browser setting. Retained GPC request samples include 5 classified advertising, marketing, analytics or replay requests, including 5 collection requests. Paired activity comparison: no observable response.Why it matters: GPC communicates a sale/sharing opt-out. Verified advertising collection or an acknowledged signal with the applicable opt-out remaining off warrants checking whether the site and its services apply that choice.Partial concernPartial concern

CCPA §1798.135; regulations §§7025–7026 ↗

Applicability

When this matters

GPC is relevant to a covered business’s sale or sharing of a California consumer’s personal information (§7025).

What to check

Determine whether each recipient’s activity is sale/sharing, including cross-context advertising, or qualifies for an exception.
Match the signal and choice to the browser/device and known account; verify request restrictions and service-provider arrangements, beyond vendor labels.

Scope to confirm: Confirm CCPA business coverage, current thresholds and exemptions for the operator and information. Scan location alone does not establish a visitor’s California residency.

Guidance reviewed 2026-10-24

Related enforcement

Sephora · 2022

California Attorney General · CCPA

The Attorney General alleged failure to disclose personal-information sales and process sale opt-outs sent through Global Privacy Control.

$1.2 million settlement resolving multiple allegations, with disclosure and opt-out remedies.

Connection to this finding: The related issue is whether sale/sharing opt-outs reach the relevant services. Vendor activity alone does not establish a legally defined sale or sharing arrangement.

Read the official case ↗

Examples reviewed 2026-10-16.

Affected pages

https://ergoveritas.com/test1.html · Starting page

Advertising activity with GPC: Google LLC · first observed +982 ms from GPC visit start; Meta Platforms, Inc. · first observed +985 ms from GPC visit start; Microsoft Corporation · first observed +987 ms from GPC visit start
Activity with GPC: 5 tracking requests observed with GPC
GPC signal: Observed on the page request and in the browser
0.5-second matched comparison: Over the same 0.5-second interval after page commit, advertising/marketing requests: 4 without GPC and 4 with GPC; analytics/replay requests: 1 without GPC and 1 with GPC.

Recommended fixes

View supporting evidence ↓

Check that GPC applies the relevant sale/sharing opt-out state and governs advertising collection.

JSON evidence

{
  "findingId": "gpc_response",
  "assessment": {
    "contractVersion": "certscore.gpc-response-assessment.v3",
    "generatedAt": "2026-10-26T19:04:01.124Z",
    "status": "no_observable_response",
    "findingTitle": "No observable GPC response",
    "legalInterpretation": "not_assessed",
    "comparison": {
      "comparable": true,
      "protocol": "passive_baseline_with_sec_gpc",
      "baselineArtifact": {
        "lane": "runtime_evidence",
        "sha256": "aceeab1966abdaa59eb78e1c31a619d4169b4b8177171e35b74a8952d447a8fd",
        "sizeBytes": 219524,
        "uri": "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/c4c071c6-9313-40b3-94de-23d50d24ba18/lanes/runtime_evidence/CanonicalEvidenceBundle.json"
      },
      "gpcArtifact": {
        "lane": "gpc_observation",
        "sha256": "7e8e52d866c1e148a37ebc9a8080100a018fd79f42fbaf88e124a6b8a6bf1129",
        "sizeBytes": 196736,
        "uri": "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/c4c071c6-9313-40b3-94de-23d50d24ba18/lanes/gpc_observation/CanonicalEvidenceBundle.json"
      },
      "enabledProof": {
        "secGpcHeaderValue": "1",
        "requestsWithSecGpc": 7,
        "requestEventIds": [
          "net_695",
          "net_698",
          "net_701",
          "net_703",
          "net_705",
          "net_707",
          "net_709"
        ],
        "navigatorGlobalPrivacyControl": true
      },
      "delivery": {
        "status": "verified",
        "baseline": {
          "contractVersion": "certscore.gpc-signal-observation.v1",
          "expectedEnabled": false,
          "documentUrlSha256": "82860f22772701655e80375f926cd1e443d63e435c11f6ea09419fd5f1b4d045",
          "contextConfigSha256": "ac0a8b73b4d2f1f1d6bff1bfa0c91b4bb57ea592b0f70ac0e05bb46592538bcb",
          "capturedAtMs": 1709,
          "documentStartedAtMs": 770,
          "frameCount": 1,
          "frames": [
            {
              "documentUrlSha256": "82860f22772701655e80375f926cd1e443d63e435c11f6ea09419fd5f1b4d045",
              "mainFrame": true,
              "navigatorValue": false
            }
          ],
          "workerCount": 0,
          "workerReadback": {
            "policyVersion": "worker_navigator_readback.v1",
            "scope": "observed_value_only_not_startup_delivery",
            "observed": 0,
            "samples": [],
            "truncated": false
          },
          "limitationKeys": []
        },
        "gpc": {
          "contractVersion": "certscore.gpc-signal-observation.v1",
          "expectedEnabled": true,
          "documentUrlSha256": "82860f22772701655e80375f926cd1e443d63e435c11f6ea09419fd5f1b4d045",
          "contextConfigSha256": "ac0a8b73b4d2f1f1d6bff1bfa0c91b4bb57ea592b0f70ac0e05bb46592538bcb",
          "prototypeSessionSha256": "15aff06f626529ce29bfed70b209c248de23745abebfebd88406a96463d7242e",
          "capturedAtMs": 1596,
          "documentStartedAtMs": 790,
          "frameCount": 1,
          "frames": [
            {
              "documentUrlSha256": "82860f22772701655e80375f926cd1e443d63e435c11f6ea09419fd5f1b4d045",
              "mainFrame": true,
              "navigatorValue": true
            }
          ],
          "workerCount": 0,
          "workerReadback": {
            "policyVersion": "worker_navigator_readback.v1",
            "scope": "observed_value_only_not_startup_delivery",
            "observed": 0,
            "samples": [],
            "truncated": false
          },
          "limitationKeys": []
        }
      },
      "coverage": {
        "status": "complete",
        "comparedThroughMs": 806
      },
      "responseBasis": "no_qualified_reduction",
      "deltas": {
        "cookies": {
          "baselineCount": 7,
          "gpcCount": 7,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "[\"_clck\",\"ergoveritas.com\",\"/\"]",
            "[\"_fbp\",\"ergoveritas.com\",\"/\"]",
            "[\"_ga_TEST1\",\"ergoveritas.com\",\"/\"]",
            "[\"MR\",\"bat.bing.com\",\"/\"]",
            "[\"MUID\",\"bing.com\",\"/\"]",
            "[\"OptanonConsent\",\"ergoveritas.com\",\"/\"]",
            "[\"tst\",\"pinterest.com\",\"/\"]"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 7,
          "samplesTruncated": false
        },
        "webStorage": {
          "baselineCount": 1,
          "gpcCount": 1,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "https://ergoveritas.com|localStorage|certscore_test1_consent_state"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 1,
          "samplesTruncated": false
        },
        "trackers": {
          "baselineCount": 9,
          "gpcCount": 9,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "Google|Google Ads / DoubleClick|advertising",
            "Google|Google|advertising",
            "Meta|Meta Pixel|advertising",
            "Meta|Meta|advertising",
            "Microsoft|Microsoft Advertising / Bing UET|advertising",
            "Microsoft|Microsoft Clarity|session_replay",
            "Microsoft|Microsoft|advertising",
            "Pinterest|Pinterest Tag|advertising",
            "Pinterest|Pinterest|advertising"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 9,
          "samplesTruncated": false
        },
        "advertisingOrMeasurementActivity": {
          "baselineCount": 9,
          "gpcCount": 9,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "Google|Google Ads / DoubleClick|advertising",
            "Google|Google|advertising",
            "Meta|Meta Pixel|advertising",
            "Meta|Meta|advertising",
            "Microsoft|Microsoft Advertising / Bing UET|advertising",
            "Microsoft|Microsoft Clarity|session_replay",
            "Microsoft|Microsoft|advertising",
            "Pinterest|Pinterest Tag|advertising",
            "Pinterest|Pinterest|advertising"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 9,
          "samplesTruncated": false
        },
        "advertisingOrMarketingActivity": {
          "baselineCount": 8,
          "gpcCount": 8,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "Google|Google Ads / DoubleClick|advertising",
            "Google|Google|advertising",
            "Meta|Meta Pixel|advertising",
            "Meta|Meta|advertising",
            "Microsoft|Microsoft Advertising / Bing UET|advertising",
            "Microsoft|Microsoft|advertising",
            "Pinterest|Pinterest Tag|advertising",
            "Pinterest|Pinterest|advertising"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 8,
          "samplesTruncated": false
        },
        "consentOrCmpBehavior": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        }
      },
      "evidenceRefs": [
        "net_695",
        "net_698",
        "net_701",
        "net_703",
        "net_705",
        "net_707",
        "net_709",
        "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/c4c071c6-9313-40b3-94de-23d50d24ba18/lanes/gpc_observation/CanonicalEvidenceBundle.json",
        "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/c4c071c6-9313-40b3-94de-23d50d24ba18/lanes/runtime_evidence/CanonicalEvidenceBundle.json"
      ],
      "limitationKeys": []
    },
    "observation": {
      "contractVersion": "certscore.gpc-bounded-observation.v1",
      "scanId": "c4c071c6-9313-40b3-94de-23d50d24ba18",
      "scope": "main_document_and_retained_http_requests",
      "status": "complete",
      "sourceSha256": "7e8e52d866c1e148a37ebc9a8080100a018fd79f42fbaf88e124a6b8a6bf1129",
      "sessionSha256": "15aff06f626529ce29bfed70b209c248de23745abebfebd88406a96463d7242e",
      "documentUrlSha256": "82860f22772701655e80375f926cd1e443d63e435c11f6ea09419fd5f1b4d045",
      "positiveEvidence": {
        "policyVersion": "gpc_positive_evidence.v1",
        "representativeDocument": true
      },
      "delivery": {
        "httpHeaderRetained": true,
        "mainNavigatorReadbackRetained": true,
        "fullContextVerified": true
      },
      "semanticProbe": "unavailable",
      "registration": {
        "basis": "current_recorded_state",
        "sale": "unknown",
        "sharing": "unknown",
        "cmpGpcSignal": "unknown",
        "causedByGpc": "not_established"
      },
      "acknowledgment": {
        "observed": false,
        "captureComplete": true
      },
      "requests": {
        "count": 7,
        "blockedBeforeTransmissionCount": 0,
        "complete": true,
        "fromMs": 743,
        "documentCommittedAtMs": 858,
        "throughMs": 1623,
        "classifiedCount": 5,
        "collectionCount": 5,
        "collectionReview": {
          "policyVersion": "gpc_collection_review.v1",
          "rows": [
            {
              "evidenceId": "net_701",
              "entityId": "ent_7509263a9ab6",
              "label": "Google LLC",
              "observedAtMs": 982,
              "purpose": "advertising",
              "httpStatus": 204,
              "qualification": {
                "policyVersion": "ca_sale_sharing_qualification.v3",
                "activity": "identified_advertising_collection",
                "basis": "google_advertising_feature_identifier",
                "processingSignals": [],
                "gpp": {
                  "policyVersion": "gpp_request_decode.v1",
                  "decoderVersion": "@iabgpp/[email protected]",
                  "status": "not_present",
                  "sectionIds": [],
                  "applicableSections": [],
                  "sections": [],
                  "requestSignals": "not_assessed",
                  "cmpComparison": "not_compared",
                  "reasons": []
                }
              }
            },
            {
              "evidenceId": "net_703",
              "entityId": "ent_f2a82736f68e",
              "label": "Meta Platforms, Inc.",
              "observedAtMs": 985,
              "purpose": "advertising",
              "httpStatus": 200,
              "qualification": {
                "policyVersion": "ca_sale_sharing_qualification.v3",
                "activity": "identified_advertising_collection",
                "basis": "meta_pixel_identifier",
                "processingSignals": [],
                "gpp": {
                  "policyVersion": "gpp_request_decode.v1",
                  "decoderVersion": "@iabgpp/[email protected]",
                  "status": "not_present",
                  "sectionIds": [],
                  "applicableSections": [],
                  "sections": [],
                  "requestSignals": "not_assessed",
                  "cmpComparison": "not_compared",
                  "reasons": []
                }
              }
            },
            {
              "evidenceId": "net_705",
              "entityId": "ent_02b1b951db45",
              "label": "Microsoft Corporation",
              "observedAtMs": 987,
              "purpose": "advertising",
              "httpStatus": 204,
              "qualification": {
                "policyVersion": "ca_sale_sharing_qualification.v3",
                "activity": "identified_advertising_collection",
                "basis": "microsoft_uet_identifier",
                "processingSignals": [],
                "gpp": {
                  "policyVersion": "gpp_request_decode.v1",
                  "decoderVersion": "@iabgpp/[email protected]",
                  "status": "not_present",
                  "sectionIds": [],
                  "applicableSections": [],
                  "sections": [],
                  "requestSignals": "not_assessed",
                  "cmpComparison": "not_compared",
                  "reasons": []
                }
              }
            }
          ]
        },
        "advertisingCollectionCount": 3,
        "advertisingCollectionEvidenceIds": [
          "net_701",
          "net_703",
          "net_705"
        ],
        "gppPropagation": {
          "contractVersion": "gpp_propagation_evidence.v1",
          "rows": []
        },
        "advertisingCollectionQualification": {
          "policyVersion": "gpc_sale_sharing_evidence.v5",
          "rows": [
            {
              "policyVersion": "ca_sale_sharing_qualification.v3",
              "activity": "identified_advertising_collection",
              "basis": "google_advertising_feature_identifier",
              "processingSignals": [],
              "gpp": {
                "policyVersion": "gpp_request_decode.v1",
                "decoderVersion": "@iabgpp/[email protected]",
                "status": "not_present",
                "sectionIds": [],
                "applicableSections": [],
                "sections": [],
                "requestSignals": "not_assessed",
                "cmpComparison": "not_compared",
                "reasons": []
              },
              "evidenceId": "net_701"
            },
            {
              "policyVersion": "ca_sale_sharing_qualification.v3",
              "activity": "identified_advertising_collection",
              "basis": "meta_pixel_identifier",
              "processingSignals": [],
              "gpp": {
                "policyVersion": "gpp_request_decode.v1",
                "decoderVersion": "@iabgpp/[email protected]",
                "status": "not_present",
                "sectionIds": [],
                "applicableSections": [],
                "sections": [],
                "requestSignals": "not_assessed",
                "cmpComparison": "not_compared",
                "reasons": []
              },
              "evidenceId": "net_703"
            },
            {
              "policyVersion": "ca_sale_sharing_qualification.v3",
              "activity": "identified_advertising_collection",
              "basis": "microsoft_uet_identifier",
              "processingSignals": [],
              "gpp": {
                "policyVersion": "gpp_request_decode.v1",
                "decoderVersion": "@iabgpp/[email protected]",
                "status": "not_present",
                "sectionIds": [],
                "applicableSections": [],
                "sections": [],
                "requestSignals": "not_assessed",
                "cmpComparison": "not_compared",
                "reasons": []
              },
              "evidenceId": "net_705"
            }
          ]
        },
        "advertisingCollectionRecipients": {
          "contractVersion": "canonical_collection_recipients.v1",
          "resolverVersion": "certscore-vendor-resolver-2026-10-25-index-envelope-v17",
          "rows": [
            {
              "evidenceId": "net_701",
              "entityId": "ent_7509263a9ab6",
              "label": "Google LLC",
              "observedAtMs": 982
            },
            {
              "evidenceId": "net_703",
              "entityId": "ent_f2a82736f68e",
              "label": "Meta Platforms, Inc.",
              "observedAtMs": 985
            },
            {
              "evidenceId": "net_705",
              "entityId": "ent_02b1b951db45",
              "label": "Microsoft Corporation",
              "observedAtMs": 987
            }
          ]
        },
        "evidenceIds": [
          "net_701",
          "net_703",
          "net_705",
          "net_707",
          "net_709"
        ],
        "samplesTruncated": false
      },
      "limitationKeys": [],
      "legalInterpretation": "not_assessed"
    }
  }
}

02Hidden outbound linksStarting pageOutbound links were concealed using off-screen positioning or zero-size styling. Review whether these links were intentionally added.Why it matters: Security and transport weaknesses can expose visitors’ information or disrupt access to the site. Review the affected requests and pages.Partial concernPartial concern

Applicability

When this matters

Unexpected hidden outbound links warrant checking whether the page content is authorised and whether the site has been altered.

What to check

Compare hidden links with intended templates, plugins and content.
Check ownership and change history before attributing them to an injection or compromise.

Scope to confirm: Use the retained technical evidence to establish exposure and impact before assessing any legal obligation.

Guidance reviewed 2026-10-24

Affected pages

https://ergoveritas.com/test1.html · Starting page

1 concealed link occurrences point to 1 external domain. 1 point to promotion.example.
Verified concealed outbound link occurrences were retained for review.

Recommended fixes

View supporting evidence ↓

Locate each listed destination hostname in the affected page's rendered DOM using browser developer tools (Elements search). Inspect the anchor and its ancestors against the retained excerpt and computed styles where available; the excerpt is not a CSS selector. Find the code that produces the link: search page content, CMS blocks, templates, theme/plugin files and tag-manager tags for that hostname. If it appears only after JavaScript runs, trace the inserting script with a DOM subtree-modification breakpoint on its parent. If the link is unintended, remove the anchor and the content or code that inserts it, rather than hiding it with different CSS. If it is intended navigation, remove the concealing rule from the responsible element and give the link visible, meaningful text in the normal layout. Preserve legitimate skip links and responsive controls after checking their intended behavior. If the owner cannot account for the insertion, review recent CMS, template, plugin and tag-manager changes and access logs; address any verified unauthorized change at its source. Concealment alone does not establish compromise. Publish the approved source change and clear any page/CDN caches. Check the rendered page again in a fresh browser session at desktop and mobile widths, including after scripts have run. Re-test: On each listed source URL, search the rendered DOM again for the destination hostname. Confirm an unwanted link is absent and does not reappear after scripts run, or that intended navigation is visibly and meaningfully labelled and keyboard-operable. Re-scan the same URL and compare its hidden-link evidence. Do not visit the outbound destination to perform these checks.

JSON evidence

{
  "siteIntegrity": {
    "scanId": "c4c071c6-9313-40b3-94de-23d50d24ba18",
    "sourceHash": "8769e8fa68e083933da0b3985ab4b7692d7f04b83306d9125d82a445d6ab79d4",
    "observationHash": "2c61944a8649a9bd8fe2f2bead55fe275a40fa5a41555e03e22d93a1b7d904ba",
    "verificationStatus": "verified",
    "contractVersion": "certscore.site-integrity-projection.v1",
    "evidenceRef": "CanonicalEvidenceBundle.json#siteIntegrityObservation",
    "observation": {
      "sourceLane": "runtime_evidence",
      "documentUrl": "https://ergoveritas.com/test1.html",
      "documentToken": "59007FC76F9BB468ECA0990C2E68A0D7",
      "capturedAt": "2026-10-26T19:03:57.279Z",
      "inspectedLinks": 6,
      "truncated": false,
      "links": [
        {
          "evidenceRef": "site_integrity:link:3",
          "destinationDomain": "promotion.example",
          "concealment": "offscreen_position",
          "codeProof": {
            "contractVersion": "certscore.site-integrity-code-proof.v1",
            "format": "sanitized_dom_excerpt",
            "lines": [
              "<main>",
              "  <div style=\"position:absolute;left:-9999px;top:-9999px\">",
              "    <a href=\"https://promotion.example/[redacted]\">[link text omitted]</a>",
              "  </div>",
              "</main>"
            ],
            "highlightedLine": 1,
            "sanitized": true,
            "truncated": false,
            "computedStyle": {
              "position": "absolute",
              "overflow": "visible",
              "fontSizePx": 16
            },
            "concealingRect": {
              "left": -9999,
              "top": -9999,
              "right": -9730.16,
              "bottom": -9975,
              "width": 268.84,
              "height": 24
            },
            "linkRect": {
              "left": -9999,
              "top": -9996,
              "right": -9730.16,
              "bottom": -9978,
              "width": 268.84,
              "height": 18
            }
          }
        }
      ],
      "contractVersion": "certscore.site-integrity-observation.v1",
      "scope": "starting_page_main_document"
    }
  }
}

03Accessibility issuesStarting pageAutomated accessibility checks found failures on 1 tested page (2 element failures). Buttons lacked discernible accessible names; Form controls lacked associated labels. Automated accessibility checks found failures on 1 tested page (1 element failure). Images lacked required text alternatives. Low-contrast text was detected on 1 tested page (1 element failure). Retained examples measured 2.32:1 (required 4.5:1). Automated checks: color-contrast.Why it matters: Missing labels, low contrast and other accessibility barriers can prevent people using assistive technology from reading content or completing tasks. Review the retained WCAG examples and test the affected journeys.ReviewReview

Applicability

When this matters

Accessibility requirements depend on the organisation, service and jurisdiction. WCAG supplies technical criteria for reviewing the observed barriers.

What to check

Check affected journeys for keyboard and assistive-technology access.
Identify applicable public-sector, private-service or contractual requirements, WCAG version/level, exceptions and compliance date; automation alone does not establish coverage.

Scope to confirm: Confirm the applicable accessibility law or contractual standard for this service and jurisdiction.

Guidance reviewed 2026-10-24

Affected pages

https://ergoveritas.com/test1.html · Starting page

Semantic labeling accessibility issue
Text alternative accessibility issue
Visual contrast accessibility issue

Recommended fixes

View accessibility breakdown in Detailed evidence ↓

Repair labels, accessible names, role/ARIA usage, and semantic structure for the retained axe examples, then rerun the accessibility scan.
For flagged images, add concise alt text describing their purpose; use alt="" for purely decorative images. Provide captions or equivalent text alternatives for other flagged media, then rerun the affected checks.
Adjust the flagged text and background colors to meet the required contrast ratio shown in the evidence. For links flagged as distinguishable only by color, add a persistent non-color cue such as an underline. Rerun the affected checks after updating the styles.

JSON evidence

{
  "presentationGroup": "accessibility",
  "groupedFindingIds": [
    "semantic_labeling_accessibility_issue",
    "text_alternative_accessibility_issue",
    "visual_contrast_accessibility_issue"
  ],
  "findings": [
    {
      "correctionSteps": [
        "Repair labels, accessible names, role/ARIA usage, and semantic structure for the retained axe examples, then rerun the accessibility scan."
      ],
      "priority": "high",
      "evidence": [
        "Automated accessibility checks found failures on 1 tested page (2 element failures). Buttons lacked discernible accessible names; Form controls lacked associated labels.",
        "CanonicalEvidenceBundle.json#accessibilityAudit",
        "Axe example: button-name/wcag2a, wcag412 on https://ergoveritas.com/test1.html; selector #test1-unnamed-button; nodes 1; impact critical; severity high; help: Buttons must have discernible text.",
        "Axe example: label/wcag2a, wcag412 on https://ergoveritas.com/test1.html; selector #test1-email; nodes 1; impact critical; severity high; help: Form elements must have labels."
      ],
      "evidenceJson": {
        "groupedEvidence": [],
        "evidenceDetails": {
          "counts": {
            "representativeAxePageCount": 1,
            "representativeAxeRuleCount": 2,
            "accessibilityExampleNodeCount": 2,
            "representativeAxeExampleCount": 2
          },
          "scanContext": {
            "pageUrl": "https://ergoveritas.com/test1.html",
            "scanMode": "initial_page_load"
          },
          "limitations": [
            "Automated scan does not determine legal status.",
            "Representative evidence is capped and should be reviewed with the full scan record before final conclusions."
          ],
          "evidenceSnippets": [
            "CanonicalEvidenceBundle.json#accessibilityAudit",
            "Axe example: button-name/wcag2a, wcag412 on https://ergoveritas.com/test1.html; selector #test1-unnamed-button; nodes 1; impact critical; severity high; help: Buttons must have discernible text.",
            "Axe example: label/wcag2a, wcag412 on https://ergoveritas.com/test1.html; selector #test1-email; nodes 1; impact critical; severity high; help: Form elements must have labels."
          ],
          "pageUrls": [
            "https://ergoveritas.com/test1.html"
          ],
          "sourceUrls": [
            "https://ergoveritas.com/test1.html"
          ],
          "sourceSignals": [
            "accessibility.audit.semantic_labeling_accessibility_issue: Semantic labeling accessibility issue"
          ],
          "evidenceFlags": [
            "representative_accessibility_examples_retained"
          ],
          "accessibilityEvidence": {
            "observed": true,
            "basis": "CanonicalEvidenceBundle.json#accessibilityAudit",
            "representativeExamplesRetained": 2,
            "representativeNodesRetained": 2,
            "affectedNodes": 2,
            "nodeCountBasis": "rule_node_occurrences",
            "pageCount": 1,
            "axeRuleId": "button-name",
            "ruleCodes": [
              "button-name",
              "label"
            ],
            "impact": "critical",
            "impacts": [
              "critical"
            ],
            "severity": "high",
            "axeEvidence": [
              {
                "ruleId": "button-name",
                "impact": "critical",
                "nodeCount": 1,
                "description": "Ensure buttons have discernible text",
                "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/button-name?application=axeAPI",
                "pageUrl": "https://ergoveritas.com/test1.html",
                "representativeNodes": [
                  {
                    "selectors": [
                      "#test1-unnamed-button"
                    ],
                    "failureSummary": "Fix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role=\"none\" or role=\"presentation\"",
                    "htmlSnippet": "<button id class type><svg aria-hidden focusable width height viewBox><path d fill stroke stroke-width></path></svg></button>"
                  }
                ],
                "representativeSelectors": [
                  "#test1-unnamed-button"
                ]
              },
              {
                "ruleId": "label",
                "impact": "critical",
                "nodeCount": 1,
                "description": "Ensure every form element has a label",
                "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/label?application=axeAPI",
                "pageUrl": "https://ergoveritas.com/test1.html",
                "representativeNodes": [
                  {
                    "selectors": [
                      "#test1-email"
                    ],
                    "failureSummary": "Fix any of the following: Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element has no placeholder attribute Element's default semantics were not overridden with role=\"none\" or role=\"presentation\"",
                    "htmlSnippet": "<input id name type>"
                  }
                ],
                "representativeSelectors": [
                  "#test1-email"
                ]
              }
            ]
          }
        },
        "evidenceRefs": [
          "https://ergoveritas.com/test1.html",
          "https://www.w3.org/WAI/standards-guidelines/wcag/"
        ],
        "findingId": "semantic_labeling_accessibility_issue"
      },
      "focus": "Accessibility",
      "id": "semantic_labeling_accessibility_issue",
      "rank": 6,
      "status": "Observed",
      "summary": "Automated accessibility checks found failures on 1 tested page (2 element failures). Buttons lacked discernible accessible names; Form controls lacked associated labels.",
      "title": "Semantic labeling accessibility issue",
      "vendors": []
    },
    {
      "correctionSteps": [
        "For flagged images, add concise alt text describing their purpose; use alt=\"\" for purely decorative images. Provide captions or equivalent text alternatives for other flagged media, then rerun the affected checks."
      ],
      "priority": "high",
      "evidence": [
        "Automated accessibility checks found failures on 1 tested page (1 element failure). Images lacked required text alternatives.",
        "CanonicalEvidenceBundle.json#accessibilityAudit",
        "Axe example: image-alt/wcag2a, wcag111 on https://ergoveritas.com/test1.html; selector #test1-missing-alt; nodes 1; impact critical; severity high; help: Images must have alternative text.",
        "https://ergoveritas.com/test1.html"
      ],
      "evidenceJson": {
        "groupedEvidence": [],
        "evidenceDetails": {
          "counts": {
            "representativeAxePageCount": 1,
            "representativeAxeRuleCount": 1,
            "accessibilityExampleNodeCount": 1,
            "representativeAxeExampleCount": 1
          },
          "scanContext": {
            "pageUrl": "https://ergoveritas.com/test1.html",
            "scanMode": "initial_page_load"
          },
          "limitations": [
            "Automated scan does not determine legal status.",
            "Representative evidence is capped and should be reviewed with the full scan record before final conclusions."
          ],
          "evidenceSnippets": [
            "CanonicalEvidenceBundle.json#accessibilityAudit",
            "Axe example: image-alt/wcag2a, wcag111 on https://ergoveritas.com/test1.html; selector #test1-missing-alt; nodes 1; impact critical; severity high; help: Images must have alternative text."
          ],
          "pageUrls": [
            "https://ergoveritas.com/test1.html"
          ],
          "sourceUrls": [
            "https://ergoveritas.com/test1.html"
          ],
          "sourceSignals": [
            "accessibility.audit.text_alternative_accessibility_issue: Text alternative accessibility issue"
          ],
          "evidenceFlags": [
            "representative_accessibility_examples_retained"
          ],
          "accessibilityEvidence": {
            "observed": true,
            "basis": "CanonicalEvidenceBundle.json#accessibilityAudit",
            "representativeExamplesRetained": 1,
            "representativeNodesRetained": 1,
            "affectedNodes": 1,
            "nodeCountBasis": "rule_node_occurrences",
            "pageCount": 1,
            "axeRuleId": "image-alt",
            "ruleCodes": [
              "image-alt"
            ],
            "impact": "critical",
            "impacts": [
              "critical"
            ],
            "severity": "high",
            "axeEvidence": [
              {
                "ruleId": "image-alt",
                "impact": "critical",
                "nodeCount": 1,
                "description": "Ensure <img> elements have alternative text or a role of none or presentation",
                "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/image-alt?application=axeAPI",
                "pageUrl": "https://ergoveritas.com/test1.html",
                "representativeNodes": [
                  {
                    "selectors": [
                      "#test1-missing-alt"
                    ],
                    "failureSummary": "Fix any of the following: Element does not have an alt attribute aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element's default semantics were not overridden with role=\"none\" or role=\"presentation\"",
                    "htmlSnippet": "<img id class width height src>"
                  }
                ],
                "representativeSelectors": [
                  "#test1-missing-alt"
                ]
              }
            ]
          }
        },
        "evidenceRefs": [
          "https://ergoveritas.com/test1.html",
          "https://www.w3.org/WAI/standards-guidelines/wcag/"
        ],
        "findingId": "text_alternative_accessibility_issue"
      },
      "focus": "Accessibility",
      "id": "text_alternative_accessibility_issue",
      "rank": 7,
      "status": "Observed",
      "summary": "Automated accessibility checks found failures on 1 tested page (1 element failure). Images lacked required text alternatives.",
      "title": "Text alternative accessibility issue",
      "vendors": []
    },
    {
      "correctionSteps": [
        "Adjust the flagged text and background colors to meet the required contrast ratio shown in the evidence. For links flagged as distinguishable only by color, add a persistent non-color cue such as an underline. Rerun the affected checks after updating the styles."
      ],
      "priority": "high",
      "evidence": [
        "Low-contrast text was detected on 1 tested page (1 element failure). Retained examples measured 2.32:1 (required 4.5:1).",
        "CanonicalEvidenceBundle.json#accessibilityAudit",
        "Axe example: color-contrast/wcag2aa, wcag143 on https://ergoveritas.com/test1.html; selector p:nth-child(9); nodes 1; impact serious; severity high; help: Elements must meet minimum color contrast ratio thresholds.",
        "https://ergoveritas.com/test1.html"
      ],
      "evidenceJson": {
        "groupedEvidence": [],
        "evidenceDetails": {
          "counts": {
            "representativeAxePageCount": 1,
            "representativeAxeRuleCount": 1,
            "accessibilityExampleNodeCount": 1,
            "representativeAxeExampleCount": 1
          },
          "scanContext": {
            "pageUrl": "https://ergoveritas.com/test1.html",
            "scanMode": "initial_page_load"
          },
          "limitations": [
            "Automated scan does not determine legal status.",
            "Representative evidence is capped and should be reviewed with the full scan record before final conclusions."
          ],
          "evidenceSnippets": [
            "CanonicalEvidenceBundle.json#accessibilityAudit",
            "Axe example: color-contrast/wcag2aa, wcag143 on https://ergoveritas.com/test1.html; selector p:nth-child(9); nodes 1; impact serious; severity high; help: Elements must meet minimum color contrast ratio thresholds."
          ],
          "pageUrls": [
            "https://ergoveritas.com/test1.html"
          ],
          "sourceUrls": [
            "https://ergoveritas.com/test1.html"
          ],
          "sourceSignals": [
            "accessibility.audit.visual_contrast_accessibility_issue: Visual contrast accessibility issue"
          ],
          "evidenceFlags": [
            "representative_accessibility_examples_retained"
          ],
          "accessibilityEvidence": {
            "observed": true,
            "basis": "CanonicalEvidenceBundle.json#accessibilityAudit",
            "representativeExamplesRetained": 1,
            "representativeNodesRetained": 1,
            "affectedNodes": 1,
            "nodeCountBasis": "rule_node_occurrences",
            "pageCount": 1,
            "axeRuleId": "color-contrast",
            "ruleCodes": [
              "color-contrast"
            ],
            "impact": "serious",
            "impacts": [
              "serious"
            ],
            "severity": "high",
            "axeEvidence": [
              {
                "ruleId": "color-contrast",
                "impact": "serious",
                "nodeCount": 1,
                "description": "Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds",
                "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/color-contrast?application=axeAPI",
                "pageUrl": "https://ergoveritas.com/test1.html",
                "representativeNodes": [
                  {
                    "selectors": [
                      "p:nth-child(9)"
                    ],
                    "failureSummary": "Fix any of the following: Element has insufficient color contrast of 2.32 (foreground color: #aaaaaa, background color: #ffffff, font size: 12.0pt (16px), font weight: normal). Expected contrast ratio of 4.5:1",
                    "htmlSnippet": "<p style></p>",
                    "colorContrast": {
                      "foregroundColor": "#aaaaaa",
                      "backgroundColor": "#ffffff",
                      "contrastRatio": 2.32,
                      "requiredContrastRatio": 4.5,
                      "fontSize": "12.0pt (16px)",
                      "fontWeight": "normal"
                    }
                  }
                ],
                "representativeSelectors": [
                  "p:nth-child(9)"
                ]
              }
            ]
          }
        },
        "evidenceRefs": [
          "https://ergoveritas.com/test1.html",
          "https://www.w3.org/WAI/standards-guidelines/wcag/"
        ],
        "findingId": "visual_contrast_accessibility_issue"
      },
      "focus": "Accessibility",
      "id": "visual_contrast_accessibility_issue",
      "rank": 8,
      "status": "Observed",
      "summary": "Low-contrast text was detected on 1 tested page (1 element failure). Retained examples measured 2.32:1 (required 4.5:1).",
      "title": "Visual contrast accessibility issue",
      "vendors": []
    }
  ]
}

Pre-consent page event timeline

Scan start

Public page observation began

1.13s

3P request

3P request first observed

1.13s

Ad vendor

Ad vendor first observed

1.13s

Non-essential request

Canonical pre-consent tracking concern observed

1.14s

Embedded content

Embedded content first observed

1.14s

Embedded content

Embedded content first observed

1.14s

Session replay

Session replay first observed

1.29s

Cookie observed

MUID · retained observation

1.71s

Device-signal review

Device-signal review first observed

6.11s

Observation end

Retained scan window closed

Pre-consent supporting evidence

Services & Resources

Resource breakdowns

15 distinct resources = 7 requests + 8 cookies & storage. Services group these resources.

Type mix

Requests7
Cookies & storage8

Evidence mix

Non-essential8
Classification review3
Unknown purpose2
Contextual1
Essential1

Purpose mix

Unknown purpose6
Advertising4
Advertising1

Site relationship

Third party8
First party7

Services and their member resources
						Domain	Site relationship
1	Google Ads / DoubleClick	Advertising	Policy disclosure · Mentioned Google Ads / DoubleClick Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. pients and service providers We share personal data in the form of synthetic cookie identifiers and network-request metadata with analytics providers including Google Analytics, advertising provider Meta, replay provider Microsoft Clarity, and advertising providers Microsoft and Pinterest. AWS is the hosting provider that receives ordinary page-request metadata. The purposes are measurement, advertising Matched at vendor level. https://ergoveritas.com/test1-privacy-policy.html#demo-form Reviewed 2026-10-26T19:04:01.847Z · Complete retained text Evidence SHA-256: ebd4043b4f57796aab835d3226e90612c96d3390a3ba1f62186b0c7366c7c8b2	Location details Google Ads / DoubleClick Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. United States 74.125.137.155 · Google LLC · AS15169 Approximate server country · Source: proxy connect iplocate Country database: 2026-10-07 Network database: 2026-10-07 1 of 1 request events assessed; 0 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed US-controlled vendor; mechanism requires current vendor/legal verification. Registry reference date: 2026-07-23. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Google LLC Google identifies Mountain View, California as its headquarters. This does not identify a customer's regional Google contracting entity or Alphabet's headquarters. Sources checked 2026-09-07 Google company history Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.13s	stats.g.doubleclick.net	Third party	Captured on 1 page https://ergoveritas.com/test1.html
1	Google Analytics	Analytics	Policy disclosure · Mentioned Google Analytics Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. pients and service providers We share personal data in the form of synthetic cookie identifiers and network-request metadata with analytics providers including Google Analytics, advertising provider Meta, replay provider Microsoft Clarity, and advertising providers Microsoft and Pinterest. AWS is the hosting provider that receives ordinary page-request metadata. The purposes are measurement, advertising classific Matched at product level. https://ergoveritas.com/test1-privacy-policy.html#demo-form Reviewed 2026-10-26T19:04:01.847Z · Complete retained text Evidence SHA-256: ebd4043b4f57796aab835d3226e90612c96d3390a3ba1f62186b0c7366c7c8b2	Location details Google Analytics Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. Complete destination coverage is not available for this historical evidence. Provider headquarters: US Transfer mechanism: Mechanism not assessed US-controlled vendor; mechanism requires current vendor/legal verification. Registry reference date: 2026-07-23. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Google LLC Google identifies Mountain View, California as its headquarters. This does not identify a customer's regional Google contracting entity or Alphabet's headquarters. Sources checked 2026-09-07 Google company history Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.72s	ergoveritas.com	First party	Captured on 1 page https://ergoveritas.com/test1.html
2	Facebook	Advertising	Policy disclosure · Mentioned Facebook Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. ersonal data in the form of synthetic cookie identifiers and network-request metadata with analytics providers including Google Analytics, advertising provider Meta, replay provider Microsoft Clarity, and advertising providers Microsoft and Pinterest. AWS is the hosting provider that receives ordinary page-request metadata. The purposes are measurement, advertising classification, session-replay class Matched at vendor level. https://ergoveritas.com/test1-privacy-policy.html#demo-form Reviewed 2026-10-26T19:04:01.847Z · Complete retained text Evidence SHA-256: ebd4043b4f57796aab835d3226e90612c96d3390a3ba1f62186b0c7366c7c8b2	Location details Facebook Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. United States 157.240.22.35 · Facebook, Inc. · AS32934 Approximate server country · Source: proxy connect iplocate Country database: 2026-10-07 Network database: 2026-10-07 1 of 1 request events assessed; 0 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Meta Platforms, Inc. Corporate headquarters listed in Menlo Park, California. This record is for Meta Platforms, Inc., not Meta Platforms Ireland Limited. Sources checked 2026-09-07 Meta 2025 Form 10-K Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.14s	ergoveritas.com Service domains ergoveritas.com www.facebook.com	Mixed	Captured on 1 page https://ergoveritas.com/test1.html
1	Microsoft Advertising / Bing UET	Advertising	Policy disclosure · Mentioned Microsoft Advertising / Bing UET Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. rm of synthetic cookie identifiers and network-request metadata with analytics providers including Google Analytics, advertising provider Meta, replay provider Microsoft Clarity, and advertising providers Microsoft and Pinterest. AWS is the hosting provider that receives ordinary page-request metadata. The purposes are measurement, advertising classification, session-replay classification and product-event Matched at vendor level. https://ergoveritas.com/test1-privacy-policy.html#demo-form Reviewed 2026-10-26T19:04:01.847Z · Complete retained text Evidence SHA-256: ebd4043b4f57796aab835d3226e90612c96d3390a3ba1f62186b0c7366c7c8b2	Location details Microsoft Advertising / Bing UET Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. United States 150.171.27.10 · Microsoft Corporation · AS8075 Approximate server country · Source: proxy connect iplocate Country database: 2026-10-07 Network database: 2026-10-07 1 of 1 request events assessed; 0 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Microsoft Corporation Microsoft identifies Redmond, Washington as its global headquarters; this does not identify a regional contracting entity. Sources checked 2026-09-07 Microsoft office locations Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.14s	bat.bing.com	Third party	Captured on 1 page https://ergoveritas.com/test1.html
2	Microsoft Clarity	Session replay	Policy disclosure · Mentioned Microsoft Clarity Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. rm of synthetic cookie identifiers and network-request metadata with analytics providers including Google Analytics, advertising provider Meta, replay provider Microsoft Clarity, and advertising providers Microsoft and Pinterest. AWS is the hosting provider that receives ordinary page-request metadata. The purposes are measurement, advertising classification, session-replay classification and product-event classif Matched at product level. https://ergoveritas.com/test1-privacy-policy.html#demo-form Reviewed 2026-10-26T19:04:01.847Z · Complete retained text Evidence SHA-256: ebd4043b4f57796aab835d3226e90612c96d3390a3ba1f62186b0c7366c7c8b2	Location details Microsoft Clarity Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. United States 4.153.187.221 · Microsoft Corporation · AS8075 Approximate server country · Source: proxy connect iplocate Country database: 2026-10-07 Network database: 2026-10-07 1 of 1 request events assessed; 0 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Microsoft Corporation Microsoft identifies Redmond, Washington as its global headquarters; this does not identify a regional contracting entity. Sources checked 2026-09-07 Microsoft office locations Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.14s	ergoveritas.com Service domains ergoveritas.com www.clarity.ms	Mixed	Captured on 1 page https://ergoveritas.com/test1.html
1	Pinterest Tag	Advertising	Policy disclosure · Mentioned Pinterest Tag Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. data with analytics providers including Google Analytics, advertising provider Meta, replay provider Microsoft Clarity, and advertising providers Microsoft and Pinterest. AWS is the hosting provider that receives ordinary page-request metadata. The purposes are measurement, advertising classification, session-replay classification and product-event classification. The page uses fixed synthetic identifiers Matched at vendor level. https://ergoveritas.com/test1-privacy-policy.html#demo-form Reviewed 2026-10-26T19:04:01.847Z · Complete retained text Evidence SHA-256: ebd4043b4f57796aab835d3226e90612c96d3390a3ba1f62186b0c7366c7c8b2	Location details Pinterest Tag Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. United States 151.101.40.84 · Fastly, Inc. · AS54113 Approximate server country · Source: proxy connect iplocate Country database: 2026-10-07 Network database: 2026-10-07 1 of 1 request events assessed; 0 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Pinterest, Inc. The filing identifies principal executive offices in San Francisco, California. Incorporation and regional Pinterest entities are separate. Sources checked 2026-09-07 Pinterest 2025 Form 10-K Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.14s	ct.pinterest.com	Third party	Captured on 1 page https://ergoveritas.com/test1.html
2	Microsoft Identity Synchronization	Advertising measurement	Policy disclosure · Mentioned Microsoft Identity Synchronization Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. rm of synthetic cookie identifiers and network-request metadata with analytics providers including Google Analytics, advertising provider Meta, replay provider Microsoft Clarity, and advertising providers Microsoft and Pinterest. AWS is the hosting provider that receives ordinary page-request metadata. The purposes are measurement, advertising classification, session-replay classification and product-event Matched at vendor level. https://ergoveritas.com/test1-privacy-policy.html#demo-form Reviewed 2026-10-26T19:04:01.847Z · Complete retained text Evidence SHA-256: ebd4043b4f57796aab835d3226e90612c96d3390a3ba1f62186b0c7366c7c8b2	Location details Microsoft Identity Synchronization Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. Complete destination coverage is not available for this historical evidence. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Microsoft Corporation Microsoft identifies Redmond, Washington as its global headquarters; this does not identify a regional contracting entity. Sources checked 2026-09-07 Microsoft office locations Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.29s	bat.bing.com Service domains bat.bing.com bing.com	Third party	Captured on 1 page https://ergoveritas.com/test1.html
1	OneTrust CMP	Consent management	Policy disclosure · Not found OneTrust CMP Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. https://ergoveritas.com/test1-privacy-policy.html#demo-form Reviewed 2026-10-26T19:04:01.847Z · Complete retained text Evidence SHA-256: ebd4043b4f57796aab835d3226e90612c96d3390a3ba1f62186b0c7366c7c8b2	Location details OneTrust CMP Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. Complete destination coverage is not available for this historical evidence. Provider headquarters: US Transfer mechanism: Mechanism not assessed US-controlled vendor; mechanism requires current vendor/legal verification. Registry reference date: 2026-07-23. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters OneTrust, LLC OneTrust lists its US headquarters in Atlanta separately from its global hubs. Sources checked 2026-09-07 OneTrust global offices Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.72s	ergoveritas.com	First party	Captured on 1 page https://ergoveritas.com/test1.html

Unattributed resources (4)

8 distinct services, including child services and unattributed resources

Forms & fields

2 form observations

Includes forms observed after the Accept click

Demo service enquiryAfter Accept click

ⓘIdentity / profile

ergoveritas.comself

ergoveritas.com/test1.html

Demo service enquiry

Observed after the Accept click. This does not establish consent registration.

POST · Checkboxes / toggles: —

Privacy disclosure 1 excerpt

These personal data fields model an enquiry, but their values stay in this document until it is closed or reloaded. The Privacy Policy explains the form and the separate test tracking activity.

Within this form

Partial excerpt

Source page

Fields in Demo service enquiry
Field	Input type	Data type	Required	State
Full name	text	ⓘIdentity / profile	No	Enabled
email	email	ⓘPersonal contact	No	Enabled
Phone number	tel	ⓘPersonal contact	No	Enabled
Postal code	text	ⓘLocation	No	Enabled
Your enquiry	textarea	ⓘUnrestricted free text	No	Enabled

Technical evidence

{
  "observationRef": "after_accept:ab06ebb9-e189-4bbe-adda-3fbf5e829e1f:collection_form_0",
  "captureProvenance": {
    "packetSha256": "2c99d72ad2e305e9548aed037e70960eee8a21ae835c357eb3e149cd4307b085",
    "sessionId": "d628f8cc-b2c2-44e9-aab9-e0075b7f8396",
    "frameRef": "accept_frame_0",
    "documentToken": "42629F39FE3929CEA5416507621997E7",
    "exactTargetSha256": "82860f22772701655e80375f926cd1e443d63e435c11f6ea09419fd5f1b4d045",
    "actionDispatchedAtMs": 2258,
    "capturedAtMs": 5115
  },
  "formRef": "collection_form_0",
  "method": "post",
  "confidence": 0.92,
  "directVsInferred": "direct",
  "evidenceRefs": [
    {
      "refId": "accept_frame_0_collection_form_0",
      "artifactId": "post_accept_forms",
      "eventType": "after_accept_form"
    }
  ],
  "fields": [
    {
      "review": {
        "version": "collection-field-review.v1",
        "category": "identity_profile",
        "preselectedMarketing": false
      },
      "fieldRef": "collection_form_0_field_0",
      "controlIndex": 0,
      "elementType": "input",
      "inputType": "text",
      "semanticCategory": "name",
      "label": "Full name",
      "required": false,
      "disabled": false,
      "readOnly": false,
      "evidenceRefs": [
        {
          "refId": "accept_frame_0_collection_form_0_field_0",
          "artifactId": "post_accept_forms",
          "eventType": "after_accept_field"
        }
      ],
      "confidence": 0.9,
      "directVsInferred": "direct"
    },
    {
      "review": {
        "version": "collection-field-review.v1",
        "category": "personal_contact",
        "preselectedMarketing": false
      },
      "fieldRef": "collection_form_0_field_1",
      "controlIndex": 1,
      "elementType": "input",
      "inputType": "email",
      "semanticCategory": "email",
      "label": "email",
      "required": false,
      "disabled": false,
      "readOnly": false,
      "evidenceRefs": [
        {
          "refId": "accept_frame_0_collection_form_0_field_1",
          "artifactId": "post_accept_forms",
          "eventType": "after_accept_field"
        }
      ],
      "confidence": 0.9,
      "directVsInferred": "direct"
    },
    {
      "review": {
        "version": "collection-field-review.v1",
        "category": "personal_contact",
        "preselectedMarketing": false
      },
      "fieldRef": "collection_form_0_field_2",
      "controlIndex": 2,
      "elementType": "input",
      "inputType": "tel",
      "semanticCategory": "phone",
      "label": "Phone number",
      "required": false,
      "disabled": false,
      "readOnly": false,
      "evidenceRefs": [
        {
          "refId": "accept_frame_0_collection_form_0_field_2",
          "artifactId": "post_accept_forms",
          "eventType": "after_accept_field"
        }
      ],
      "confidence": 0.9,
      "directVsInferred": "direct"
    },
    {
      "review": {
        "version": "collection-field-review.v1",
        "category": "location",
        "preselectedMarketing": false
      },
      "fieldRef": "collection_form_0_field_3",
      "controlIndex": 3,
      "elementType": "input",
      "inputType": "text",
      "semanticCategory": "address",
      "label": "Postal code",
      "required": false,
      "disabled": false,
      "readOnly": false,
      "evidenceRefs": [
        {
          "refId": "accept_frame_0_collection_form_0_field_3",
          "artifactId": "post_accept_forms",
          "eventType": "after_accept_field"
        }
      ],
      "confidence": 0.9,
      "directVsInferred": "direct"
    },
    {
      "review": {
        "version": "collection-field-review.v1",
        "category": "free_text",
        "preselectedMarketing": false
      },
      "fieldRef": "collection_form_0_field_4",
      "controlIndex": 4,
      "elementType": "textarea",
      "inputType": "textarea",
      "semanticCategory": "free_text",
      "label": "Your enquiry",
      "required": false,
      "disabled": false,
      "readOnly": false,
      "evidenceRefs": [
        {
          "refId": "accept_frame_0_collection_form_0_field_4",
          "artifactId": "post_accept_forms",
          "eventType": "after_accept_field"
        }
      ],
      "confidence": 0.9,
      "directVsInferred": "direct"
    }
  ]
}

Demo service enquiryPage observation

ⓘIdentity / profile

ergoveritas.comself

ergoveritas.com/test1.html

Demo service enquiry

POST · Checkboxes / toggles: —

Privacy disclosure 1 excerpt

These personal data fields model an enquiry, but their values stay in this document until it is closed or reloaded. The Privacy Policy explains the form and the separate test tracking activity.

Within this form

Source page

Fields in Demo service enquiry
Field	Input type	Data type	Required	State
Full name	text	ⓘIdentity / profile	No	Enabled
email	email	ⓘPersonal contact	No	Enabled
Phone number	tel	ⓘPersonal contact	No	Enabled
Postal code	text	ⓘLocation	No	Enabled
Your enquiry	textarea	ⓘUnrestricted free text	No	Enabled

Technical evidence

{
  "observationRef": "collection_form_0",
  "formRef": "collection_form_0",
  "method": "post",
  "confidence": 0.92,
  "directVsInferred": "direct",
  "evidenceRefs": [
    {
      "refId": "ref_collection_surface_form_0",
      "eventType": "main_document_dom_form",
      "artifactId": "collection_surface_inventory_pre_consent"
    }
  ],
  "fields": [
    {
      "label": "Full name",
      "review": {
        "version": "collection-field-review.v1",
        "category": "identity_profile",
        "preselectedMarketing": false
      },
      "disabled": false,
      "fieldRef": "collection_form_0_field_0",
      "readOnly": false,
      "required": false,
      "inputType": "text",
      "confidence": 0.9,
      "elementType": "input",
      "controlIndex": 0,
      "evidenceRefs": [
        {
          "refId": "ref_collection_surface_0_0",
          "eventType": "main_document_dom_control",
          "artifactId": "collection_surface_inventory_pre_consent"
        }
      ],
      "directVsInferred": "direct",
      "semanticCategory": "name"
    },
    {
      "label": "email",
      "review": {
        "version": "collection-field-review.v1",
        "category": "personal_contact",
        "preselectedMarketing": false
      },
      "disabled": false,
      "fieldRef": "collection_form_0_field_1",
      "readOnly": false,
      "required": false,
      "inputType": "email",
      "confidence": 0.9,
      "elementType": "input",
      "controlIndex": 1,
      "evidenceRefs": [
        {
          "refId": "ref_collection_surface_0_1",
          "eventType": "main_document_dom_control",
          "artifactId": "collection_surface_inventory_pre_consent"
        }
      ],
      "directVsInferred": "direct",
      "semanticCategory": "email"
    },
    {
      "label": "Phone number",
      "review": {
        "version": "collection-field-review.v1",
        "category": "personal_contact",
        "preselectedMarketing": false
      },
      "disabled": false,
      "fieldRef": "collection_form_0_field_2",
      "readOnly": false,
      "required": false,
      "inputType": "tel",
      "confidence": 0.9,
      "elementType": "input",
      "controlIndex": 2,
      "evidenceRefs": [
        {
          "refId": "ref_collection_surface_0_2",
          "eventType": "main_document_dom_control",
          "artifactId": "collection_surface_inventory_pre_consent"
        }
      ],
      "directVsInferred": "direct",
      "semanticCategory": "phone"
    },
    {
      "label": "Postal code",
      "review": {
        "version": "collection-field-review.v1",
        "category": "location",
        "preselectedMarketing": false
      },
      "disabled": false,
      "fieldRef": "collection_form_0_field_3",
      "readOnly": false,
      "required": false,
      "inputType": "text",
      "confidence": 0.9,
      "elementType": "input",
      "controlIndex": 3,
      "evidenceRefs": [
        {
          "refId": "ref_collection_surface_0_3",
          "eventType": "main_document_dom_control",
          "artifactId": "collection_surface_inventory_pre_consent"
        }
      ],
      "directVsInferred": "direct",
      "semanticCategory": "address"
    },
    {
      "label": "Your enquiry",
      "review": {
        "version": "collection-field-review.v1",
        "category": "free_text",
        "preselectedMarketing": false
      },
      "disabled": false,
      "fieldRef": "collection_form_0_field_4",
      "readOnly": false,
      "required": false,
      "inputType": "textarea",
      "confidence": 0.9,
      "elementType": "textarea",
      "controlIndex": 4,
      "evidenceRefs": [
        {
          "refId": "ref_collection_surface_0_4",
          "eventType": "main_document_dom_control",
          "artifactId": "collection_surface_inventory_pre_consent"
        }
      ],
      "directVsInferred": "direct",
      "semanticCategory": "free_text"
    }
  ]
}

Detailed evidence

Privacy & security ratingsStarting page

30 rows

2concern5Review18positive5contextual

Review the verified GPC findings

GPC delivery: Verified on this page; Signal retained on the page request and in the browser.

CertScore.ai can make mistakes. Verify all findings.

Signal Snapshot

Consent platformOneTrust

OneTrustView CMP details ↓

Consent controls3 of 3 observed

Consent choices

Observed

Reject

Observed

Options

Observed

Initial visit · first layer

After Accept

Consent unconfirmed

After-Accept observation recorded

The Accept click and observation completed, but the consent decision could not be confirmed. During 3.01s of after-click observation, 0 requests were retained and 0 main-document storage writes were observed. A post-click storage snapshot was retained. Request totals include all retained after-click requests; tracking classifications are shown in the findings.

3s maximum · TCF + CMP registry resolver

After Reject

Succeeded with confirmation

Non-essential cookies or services after Reject

1 classified non-essential cookie(s) and 1 non-essential service request(s) were observed after the Reject control was clicked. Cookie presence does not establish active use or verify refusal registration.

8s maximum · TCF + CMP registry resolver

Policy surfaces1 found

https://ergoveritas.com/test1-privacy-policy.html#demo-form

California coverage3 assessed

Sale/sharing opt-outObserved

“Do Not Sell or Share My Personal Information”

Frictionless GPC exception

Conflicting evidence· Advertising collection observed under GPC.

Frictionless GPC policy declarations
Policy disclosure	Evidence
Opt-out right described in policy	Unresolved
Frictionless processing statement	Unresolved
Instructions to enable the signal

Transport security5 of 5 observed

HTTPS delivery for scanned pages
Valid SSL/TLS certificate
HTTP redirects to HTTPS
Mixed content
Observed form transport

Accessibility (WCAG)5 issues

Button names
Low text contrast
Image text alternatives
Form field labels
Zoom restrictions

View accessibility issues & evidence ↓

Preview or select the package

CertScore.ai — developer fix and retest package
Scan: c4c071c6-9313-40b3-94de-23d50d24ba18
Target: https://ergoveritas.com/test1.html
Scan region: California
Scan date: 2026-10-26T19:03:55.062Z

OBSERVED RESULTS
GPC delivery: Verified on this page. Signal retained on the page request and in the browser.
Site-recorded opt-out: Not observable in this result. A readable preference interface is optional evidence; it is not required to evaluate retained activity.
Opt-out method: Method or instructions observed. Finding a method does not establish that it was used or worked.
Explicit opt-out test: No verified action result. GPC delivery, a visible link and a cookie Reject click do not establish a completed sale/sharing opt-out.
3 successful advertising collection requests retained with GPC enabled.
GPC capture: complete; request coverage: complete within the retained scope; retained through +1623 ms from visit start.

RETAINED REQUEST REFERENCES
Google LLC — net_701; +982 ms from GPC visit start
Meta Platforms, Inc. — net_703; +985 ms from GPC visit start
Microsoft Corporation — net_705; +987 ms from GPC visit start
Open these request references in the report's GPC evidence. The initiating tag or code location is not established by this package; inspect the request's Initiator when reproducing.

FIX INVESTIGATION — EXISTING VERIFIED FINDINGS
1. Qualified identified collection, advertising, audience or synchronization activity was observed under verified GPC delivery.
Owner: Developer + integration/tag-manager owner; privacy owner confirms purpose
Evidence: Google LLC — net_701; +982 ms from GPC visit start
Evidence: Retained recipient — net_703; +985 ms from GPC visit start
Evidence: Microsoft Corporation — net_705; +987 ms from GPC visit start
  1. Locate each cited request in DevTools Network and inspect its Initiator to trace the integration, tag, SDK or server forwarding route. Inspect applicable purpose and effective privacy configuration using synthetic test data.
  2. Review request-local restrictions separately from independently qualifying requests. If behavior conflicts with the approved purpose or choice, correct the initiating integration's privacy settings and guard queued or delayed callbacks. Verify the resulting request fields and downstream configuration.
Retest: Compare independent fresh GPC-off and GPC-on visits to the same URL and region. Verify actual header/browser delivery, record each visit's CMP state and inspect the cited requests over equal windows, including later callbacks. Retain sanitized evidence; a current state or zero early-window activity alone does not establish honoring.

EXPLICIT OPT-OUT — SEPARATE PATH
Owner: developer + CMP/integration owner; privacy owner confirms intended scope.
A completed explicit sale/sharing test is not established. In a fresh test session, locate the site's method, record the control or instructions used, whether submission completes, and the confirmed choice. Inspect subsequent activity separately. If a step fails, fix that specific control or integration and repeat the same path; do not infer a defect from missing capture alone.
Cookie Reject and GPC acknowledgment do not substitute for this explicit opt-out test.

RETEST ACCEPTANCE
Retain the same target, region, choice path and comparable observation windows. Confirm the intended configuration change and inspect the cited recipient requests and processing declarations. Record remaining activity and incomplete coverage; neither an acknowledgment nor an empty sample is a compliance verdict.
This package contains report context and request references. Use the retained report for full evidence and coverage limits.

Site integrity

1 hidden links · 1 page

Review

Link occurrences

Affected pages

Destination domains

Links were hidden using off-screen positioning or zero-size styling. Review the destinations and affected pages to confirm whether the links belong on the site.

Expand a destination to see its pages

promotion.exampleReview1 link · 1 page · Positioned far off-screen

/test1.html1 link
View code evidence
Positioned far off-screen
Link bounds: right -9730.16px, bottom -9978px relative to the viewport. Hiding element: position absolute.
```
<main>  <div style="position:absolute;left:-9999px;top:-9999px">    <a href="https://promotion.example/[redacted]">[link text omitted]</a>  </div></main>
```
Highlighted: the element responsible for concealment. Measurements above use computed styles, including stylesheet rules.
Sanitized DOM excerpt. Text, URL paths and unrelated attributes omitted.
Capture details
https://ergoveritas.com/test1.html
Captured 2026-10-26T19:03:57.279Z
Evidence: site_integrity:link:3
Source hash: 8769e8fa68e083933da0b3985ab4b7692d7f04b83306d9125d82a445d6ab79d4

JSON evidence

{
  "destinationDomain": "promotion.example",
  "pages": [
    {
      "scanId": "c4c071c6-9313-40b3-94de-23d50d24ba18",
      "sourceHash": "8769e8fa68e083933da0b3985ab4b7692d7f04b83306d9125d82a445d6ab79d4",
      "observationHash": "2c61944a8649a9bd8fe2f2bead55fe275a40fa5a41555e03e22d93a1b7d904ba",
      "verificationStatus": "verified",
      "contractVersion": "certscore.site-integrity-projection.v1",
      "evidenceRef": "CanonicalEvidenceBundle.json#siteIntegrityObservation",
      "observation": {
        "sourceLane": "runtime_evidence",
        "documentUrl": "https://ergoveritas.com/test1.html",
        "documentToken": "59007FC76F9BB468ECA0990C2E68A0D7",
        "capturedAt": "2026-10-26T19:03:57.279Z",
        "inspectedLinks": 6,
        "truncated": false,
        "links": [
          {
            "evidenceRef": "site_integrity:link:3",
            "destinationDomain": "promotion.example",
            "concealment": "offscreen_position",
            "codeProof": {
              "contractVersion": "certscore.site-integrity-code-proof.v1",
              "format": "sanitized_dom_excerpt",
              "lines": [
                "<main>",
                "  <div style=\"position:absolute;left:-9999px;top:-9999px\">",
                "    <a href=\"https://promotion.example/[redacted]\">[link text omitted]</a>",
                "  </div>",
                "</main>"
              ],
              "highlightedLine": 1,
              "sanitized": true,
              "truncated": false,
              "computedStyle": {
                "position": "absolute",
                "overflow": "visible",
                "fontSizePx": 16
              },
              "concealingRect": {
                "left": -9999,
                "top": -9999,
                "right": -9730.16,
                "bottom": -9975,
                "width": 268.84,
                "height": 24
              },
              "linkRect": {
                "left": -9999,
                "top": -9996,
                "right": -9730.16,
                "bottom": -9978,
                "width": 268.84,
                "height": 18
              }
            }
          }
        ],
        "contractVersion": "certscore.site-integrity-observation.v1",
        "scope": "starting_page_main_document"
      }
    }
  ]
}

Correction steps

01Locate each listed destination hostname in the affected page's rendered DOM using browser developer tools (Elements search). Inspect the anchor and its ancestors against the retained excerpt and computed styles where available; the excerpt is not a CSS selector. Find the code that produces the link: search page content, CMS blocks, templates, theme/plugin files and tag-manager tags for that hostname. If it appears only after JavaScript runs, trace the inserting script with a DOM subtree-modification breakpoint on its parent. If the link is unintended, remove the anchor and the content or code that inserts it, rather than hiding it with different CSS. If it is intended navigation, remove the concealing rule from the responsible element and give the link visible, meaningful text in the normal layout. Preserve legitimate skip links and responsive controls after checking their intended behavior. If the owner cannot account for the insertion, review recent CMS, template, plugin and tag-manager changes and access logs; address any verified unauthorized change at its source. Concealment alone does not establish compromise. Publish the approved source change and clear any page/CDN caches. Check the rendered page again in a fresh browser session at desktop and mobile widths, including after scripts have run. Re-test: On each listed source URL, search the rendered DOM again for the destination hostname. Confirm an unwanted link is absent and does not reappear after scripts run, or that intended navigation is visibly and meaningfully labelled and keyboard-operable. Re-scan the same URL and compare its hidden-link evidence. Do not visit the outbound destination to perform these checks.

Capture coverage · 1 of 1 pages

Coverage follows the scan’s page limit and excludes unvisited pages.

/test1.htmlRetained

Counts include occurrences on different pages. Concealment alone does not establish compromise or personal-data disclosure. Destination pages were not opened.

CMP details

13 checks · 1 to review · 6 limited

Review

OneTrust

Consent management audit · 13 criteria

Reject optionObservedReject or an equivalent refusal option was available on the banner.

View consent choices ↓

JSON evidence

{
  "scope": "starting_page",
  "scanId": "c4c071c6-9313-40b3-94de-23d50d24ba18",
  "assessmentSourceHash": "fnv1a-9aec5a0d",
  "criterion": {
    "id": "reject",
    "label": "Option to reject cookies available",
    "status": "Observed",
    "detail": "First-layer Reject or equivalent refusal control.",
    "sourceIds": [
      "consentControlAssessment.controls.reject"
    ]
  }
}

Accept / Reject prominenceObservedAccept and Reject were compared in the captured view. No material prominence difference met the review threshold.

Accept / Reject comparison

Accept / Reject comparison
Control	Size (px)	Fill contrast
Accept	204.83 × 48	1.151:1

Privacy-policy linkObservedA privacy-policy link or page was found.

View supporting evidence ↓

JSON evidence

{
  "scope": "starting_page",
  "scanId": "c4c071c6-9313-40b3-94de-23d50d24ba18",
  "assessmentSourceHash": "fnv1a-9aec5a0d",
  "criterion": {
    "id": "privacy_link",
    "label": "Link to privacy policy available",
    "status": "Observed",
    "detail": "Public privacy-policy link or surface on the scanned page.",
    "sourceIds": [
      "privacy_notice_availability"
    ]
  }
}

Consent storage observedObservedBrowser consent records were stored or updated after Accept and Reject.

Browser consent records

Browser consent records
Choice	Cookie	Observed
Accept

Activity after Accept / RejectReview1 classified non-essential cookie(s) and 1 non-essential service request(s) were observed after the Reject control was clicked. Cookie presence does not establish active use or verify refusal registration.

After Accept · 3 seconds · 0 requests · 0 classified as non-essential

After Reject · 0.353 seconds · 1 request · 1 classified as non-essential

Requests after Reject · 1

Requests after Reject · 1
Service	Purpose	Session offset	Request

CMP cookie expiryObservedCMP cookie expiry was captured. Time remaining is shown below.

CMP cookie expiry · 3

CMP cookie expiry · 3
Capture	Cookie	Remaining days
Before choice

Not assessed · 6 checks

Category choicesNot assessedEvidence was not retained for this check.

JSON evidence

{
  "scope": "starting_page",
  "scanId": "c4c071c6-9313-40b3-94de-23d50d24ba18",
  "assessmentSourceHash": "fnv1a-9aec5a0d",
  "criterion": {
    "id": "categories",
    "label": "Selection by categories available",
    "status": "Not assessed",
    "detail": "Evidence was not retained for this check.",
    "sourceIds": []
  }
}

CMP service listNot assessedEvidence was not retained for this check.

JSON evidence

{
  "scope": "starting_page",
  "scanId": "c4c071c6-9313-40b3-94de-23d50d24ba18",
  "assessmentSourceHash": "fnv1a-9aec5a0d",
  "criterion": {
    "id": "services",
    "label": "Individual services identified in the CMP",
    "status": "Not assessed",
    "detail": "Evidence was not retained for this check.",
    "sourceIds": []
  }
}

Tracking & embeds

No checks available

Policies & disclosures

No checks available

Accessibility (WCAG)

5 issues · 5 affected elements

Review

WCAG 2.2 A/AA automated checks on the starting page.

axe-core 4.11.3 · 63 rules evaluated

Button namesIssues found1 element affected

Controls need an accessible name describing their action.

Impact: Critical

WCAG criteria: 4.1.2

WCAG guidance & remediation ↗

Examples (1 of 1)

Sanitized selector hints (exactness unverified): #test1-unnamed-button

Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role="none" or role="presentation"

<button id class type><svg aria-hidden focusable width height viewBox><path d fill stroke stroke-width></path></svg></button>

JSON evidence

{
  "accessibilityRule": {
    "ruleId": "button-name",
    "impact": "critical",
    "tags": [
      "cat.name-role-value",
      "wcag2a",
      "wcag412",
      "section508",
      "section508.22.a",
      "TTv5",
      "TT6.a",
      "EN-301-549",
      "EN-9.4.1.2",
      "ACT",
      "RGAAv4",
      "RGAA-11.9.1"
    ],
    "help": "Buttons must have discernible text",
    "description": "Ensure buttons have discernible text",
    "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/button-name?application=axeAPI",
    "nodeCount": 1,
    "representativeNodes": [
      {
        "mainDocumentBound": true,
        "selectors": [
          "#test1-unnamed-button"
        ],
        "htmlSnippet": "<button id class type><svg aria-hidden focusable width height viewBox><path d fill stroke stroke-width></path></svg></button>",
        "failureSummary": "Fix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> Element's default semantics were not overridden with role=\"none\" or role=\"presentation\""
      }
    ]
  }
}

Correction steps

01Add meaningful button text or an accessible label to each flagged control. Check that the announced name describes its action.

Low text contrastIssues found1 element affected

Text must have sufficient contrast against its background.

Impact: Serious

WCAG criteria: 1.4.3

WCAG guidance & remediation ↗

Examples (1 of 1)

Sanitized selector hints (exactness unverified): p:nth-child(9)

Element has insufficient color contrast of 2.32 (foreground color: #aaaaaa, background color: #ffffff, font size: 12.0pt (16px), font weight: normal). Expected contrast ratio of 4.5:1

<p style></p>

JSON evidence

{
  "accessibilityRule": {
    "ruleId": "color-contrast",
    "impact": "serious",
    "tags": [
      "cat.color",
      "wcag2aa",
      "wcag143",
      "TTv5",
      "TT13.c",
      "EN-301-549",
      "EN-9.1.4.3",
      "ACT",
      "RGAAv4",
      "RGAA-3.2.1"
    ],
    "help": "Elements must meet minimum color contrast ratio thresholds",
    "description": "Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds",
    "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/color-contrast?application=axeAPI",
    "nodeCount": 1,
    "representativeNodes": [
      {
        "mainDocumentBound": true,
        "selectors": [
          "p:nth-child(9)"
        ],
        "htmlSnippet": "<p style></p>",
        "failureSummary": "Fix any of the following: Element has insufficient color contrast of 2.32 (foreground color: #aaaaaa, background color: #ffffff, font size: 12.0pt (16px), font weight: normal). Expected contrast ratio of 4.5:1",
        "colorContrast": {
          "foregroundColor": "#aaaaaa",
          "backgroundColor": "#ffffff",
          "contrastRatio": 2.32,
          "requiredContrastRatio": 4.5,
          "fontSize": "12.0pt (16px)",
          "fontWeight": "normal"
        }
      }
    ]
  }
}

Correction steps

01Adjust the text or background colors to meet the required ratio shown in each example, then retest.

Image text alternativesIssues found1 element affected

Images need a text alternative that conveys their purpose.

Impact: Critical

WCAG criteria: 1.1.1

WCAG guidance & remediation ↗

Examples (1 of 1)

Sanitized selector hints (exactness unverified): #test1-missing-alt

Element does not have an alt attribute aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element's default semantics were not overridden with role="none" or role="presentation"

<img id class width height src>

JSON evidence

{
  "accessibilityRule": {
    "ruleId": "image-alt",
    "impact": "critical",
    "tags": [
      "cat.text-alternatives",
      "wcag2a",
      "wcag111",
      "section508",
      "section508.22.a",
      "TTv5",
      "TT7.a",
      "TT7.b",
      "EN-301-549",
      "EN-9.1.1.1",
      "ACT",
      "RGAAv4",
      "RGAA-1.1.1"
    ],
    "help": "Images must have alternative text",
    "description": "Ensure <img> elements have alternative text or a role of none or presentation",
    "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/image-alt?application=axeAPI",
    "nodeCount": 1,
    "representativeNodes": [
      {
        "mainDocumentBound": true,
        "selectors": [
          "#test1-missing-alt"
        ],
        "htmlSnippet": "<img id class width height src>",
        "failureSummary": "Fix any of the following: Element does not have an alt attribute aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element's default semantics were not overridden with role=\"none\" or role=\"presentation\"",
        "imageLinkIdentity": {
          "contractVersion": "certscore.accessibility-image-link-identity.v1",
          "nodeId": 1,
          "imageOnlyLinkId": null
        }
      }
    ]
  }
}

Correction steps

01Add meaningful alt text to informative images. Use an empty alt attribute for purely decorative images, then check how each image is announced.

Form field labelsIssues found1 element affected

Form controls need labels that identify the information requested.

Impact: Critical

WCAG criteria: 4.1.2

WCAG guidance & remediation ↗

Examples (1 of 1)

Sanitized selector hints (exactness unverified): #test1-email

Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element has no placeholder attribute Element's default semantics were not overridden with role="none" or role="presentation"

<input id name type>

JSON evidence

{
  "accessibilityRule": {
    "ruleId": "label",
    "impact": "critical",
    "tags": [
      "cat.forms",
      "wcag2a",
      "wcag412",
      "section508",
      "section508.22.n",
      "TTv5",
      "TT5.c",
      "EN-301-549",
      "EN-9.4.1.2",
      "ACT",
      "RGAAv4",
      "RGAA-11.1.1"
    ],
    "help": "Form elements must have labels",
    "description": "Ensure every form element has a label",
    "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/label?application=axeAPI",
    "nodeCount": 1,
    "representativeNodes": [
      {
        "mainDocumentBound": true,
        "selectors": [
          "#test1-email"
        ],
        "htmlSnippet": "<input id name type>",
        "failureSummary": "Fix any of the following: Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element has no placeholder attribute Element's default semantics were not overridden with role=\"none\" or role=\"presentation\""
      }
    ]
  }
}

Correction steps

01Associate a descriptive label with each flagged field, preferably using a visible label. Verify the label is announced when the field receives focus.

Zoom restrictionsIssues found1 element affected

Visitors need to be able to zoom the page.

Impact: Moderate

WCAG criteria: 1.4.4

WCAG guidance & remediation ↗

Examples (1 of 1)

Sanitized selector hints (exactness unverified): meta[name]

user-scalable=no on <meta> tag disables zooming on mobile devices

<meta name content>

JSON evidence

{
  "accessibilityRule": {
    "ruleId": "meta-viewport",
    "impact": "moderate",
    "tags": [
      "cat.sensory-and-visual-cues",
      "wcag2aa",
      "wcag144",
      "EN-301-549",
      "EN-9.1.4.4",
      "ACT",
      "RGAAv4",
      "RGAA-10.4.2"
    ],
    "help": "Zooming and scaling must not be disabled",
    "description": "Ensure <meta name=\"viewport\"> does not disable text scaling and zooming",
    "helpUrl": "https://dequeuniversity.com/rules/axe/4.11/meta-viewport?application=axeAPI",
    "nodeCount": 1,
    "representativeNodes": [
      {
        "selectors": [
          "meta[name]"
        ],
        "htmlSnippet": "<meta name content>",
        "failureSummary": "Fix any of the following: user-scalable=no on <meta> tag disables zooming on mobile devices"
      }
    ]
  }
}

Correction steps

01Remove viewport settings that block or limit zoom, then test text enlargement and page usability on mobile.

Cookies & tracking

No checks available

California privacy review

1 choice · 1 notice

Choices found: Do Not Sell or Share My Personal Information
Disclosures captured: Sale/sharing · Collection/purposes · Retention · Privacy rights · Opt-out methods
Rights wording found: Access · Deletion · Correction

View GPC evidence ↓

Evidence & assessment details

Assessment coverage

Assessed against CCPA/CPRA requirements assuming the law applies. Business applicability is undetermined.

Privacy notice · Partly assessed · wording needs interpretation: Verified policy text inspected for categories, purposes and retention; presence does not establish adequacy.
California rights disclosures · Assessed: disclosure gaps found: Clause inspection: right to know, right to delete, right to correct wording retained; non discrimination not observed. California adequacy remains separate.
Privacy request methods · Assessed: Retained request instructions or a visible named route establish discoverability; submission functionality is untested.
Notice at collection · Partly assessed · purpose unresolved: 2 of 3 collection points have category wording; 0 have relevant purpose wording. Product-name lookups are separate technical context.
Sale/sharing disclosures · Policy text assessed · recipient roles unresolved: Policy wording assessed: operational/analytics claims and explicit sale/sharing statements are retained separately. Actual recipient roles and applicable obligations remain unresolved.
Sale/sharing choices · Limited capture · capture incomplete

Connection security

5 checks · 5 observed

HTTPS deliveryObservedThe scanned page used HTTPS.

JSON evidence

ref_transport_security

Full evidence JSON

{"assessmentStatus":"checked","checklistItemId":"transport_security_https_delivery","coverageArea":"HTTPS delivery for scanned pages","evidenceState":"observed","explanation":"Whether the retained scanned page was served over HTTPS.","note":"Whether the retained scanned page was served over HTTPS.","status":"Observed","tone":"warning","pipeline":{"projectionStage":"coverage_policy","concernPolicyKey":"gdpr_eprivacy_coverage.transport_security_https_delivery.observed","ws01EvidenceRole":"observed runtime signal identification, evidence capture, and logging","wc01NormalizedConcernKey":"gdpr_eprivacy.coverage.transport_security_https_delivery"},"statusBasis":"The scanned page was served over HTTPS in the retained transport observation.","retainedEvidence":{"finalUrl":"https://ergoveritas.com/test1.html","finalScheme":"https","evidenceRefs":["ref_transport_security"],"httpProbeStatus":200,"sampledPageUrls":["https://ergoveritas.com/test1.html"],"httpProbeOutcome":"redirected_to_https","httpProbeFinalUrl":"https://ergoveritas.com/","pageHttpsObserved":true,"tlsProbeAttempted":true,"formInventoryState":"complete","formTransportCount":5,"httpProbeAttempted":true,"validTlsCertificate":true,"httpProbeFinalScheme":"https","httpRedirectsToHttps":true,"mixedContentObserved":false,"missingEvidenceNeeded":[],"httpProbeRedirectChain":["http://ergoveritas.com/","https://ergoveritas.com/"],"selectedEvidenceReason":"Selected the strongest retained canonical coverage evidence available for this row.","weakerArtifactsIgnored":[],"selectedEvidenceStrength":"moderate","mixedContentObservedCount":0,"selectedEvidenceArtifactId":"coverage_policy","tlsCertificateObservations":[{"issuer":"CN=Amazon RSA 2048 M04, O=Amazon","subject":"CN=ergoveritas.com","validTo":"Feb 19 23:59:59 2027 GMT","inputUrl":"https://ergoveritas.com/","validFrom":"Aug  6 00:00:00 2026 GMT","validCertificate":true,"chainCertificateCount":4}],"insecureFormTransportObserved":false},"projectedFindings":[],"missingOrIncompleteSourceSignals":[]}

Global Privacy Control

Risk observed

Review

Retained GPC request sample: 5 classified tracking requests, including 5 collection requests. Verified advertising collection: 3 requests.

Advertising recipients observed with GPC

Google LLC · 1 collection request1 identified advertising, audience or synchronization request with GPC enabled · observed at 0.98 s after GPC visit start
Meta Platforms, Inc. · 1 collection request1 identified advertising, audience or synchronization request with GPC enabled · observed at 0.98 s after GPC visit start
Microsoft Corporation · 1 collection request1 identified advertising, audience or synchronization request with GPC enabled · observed at 0.99 s after GPC visit start

Advertising activity with GPC: Google LLC · first observed +982 ms from GPC visit start; Meta Platforms, Inc. · first observed +985 ms from GPC visit start; Microsoft Corporation · first observed +987 ms from GPC visit start
GPC signal: Observed on the page request and in the browser
0.5-second matched comparison: Over the same 0.5-second interval after page commit, advertising/marketing requests: 4 without GPC and 4 with GPC; analytics/replay requests: 1 without GPC and 1 with GPC.

Baseline → GPC

Requests observed during the first 500 milliseconds after each page loaded.

Tech stack observed

CloudFront

Observed CMS, technologies and plugins with versions, scope, confidence and supporting evidence
Technology	Version	Scope	Confidence	Evidence
CloudFrontCDN / delivery	—	Delivery infrastructure	High	... Supporting evidence is shown below this row.
Response header: via: CloudFront; x-amz-cf-id: presenthttps://ergoveritas.com/test1.htmlSource: resp_739 Rules: cloudfront.response-header.v1

Reject	OptanonConsent	Updated after choice

JSON evidence

{
  "scope": "starting_page",
  "scanId": "c4c071c6-9313-40b3-94de-23d50d24ba18",
  "assessmentSourceHash": "fnv1a-9aec5a0d",
  "criterion": {
    "id": "implementation",
    "label": "Activity after Accept / Reject",
    "status": "Review recommended",
    "detail": "1 classified non-essential cookie(s) and 1 non-essential service request(s) were observed after the Reject control was clicked. Cookie presence does not establish active use or verify refusal registration.",
    "sourceIds": [
      "post_reject_tracking_reduction"
    ],
    "supportingEvidence": {
      "inventory": {
        "choiceActivity": [
          {
            "action": "accept",
            "windowMs": 3000,
            "requestCount": 0,
            "nonEssentialRequestCount": 0,
            "requests": []
          },
          {
            "action": "reject",
            "windowMs": 353,
            "requestCount": 1,
            "nonEssentialRequestCount": 1,
            "requests": [
              {
                "hostname": "stats.g.doubleclick.net",
                "path": "/g/collect",
                "vendor": "Google",
                "purpose": "advertising",
                "msAfterClick": 77,
                "nonEssential": true
              }
            ]
          }
        ]
      }
    }
  }
}

Correction steps

01Filter the cited post-refusal endpoint in DevTools Network and inspect its Initiator stack. Locate its tag, timer, retry, queued callback or storage writer. Use the retained confirmation-relative timing to separate a new request chain from one already in flight; cookie presence alone does not prove active use.
02In the Reject handler, persist denied optional categories and apply them to each consent-dependent loader and collection call before queued work can run. Cancel pending optional timers/retries and use the vendor's documented disable/consent mechanism for an already-loaded SDK. Guard SPA navigation and later callbacks against reinitializing it.
03Stop the cited optional writes at their source. If cleanup is appropriate, remove only the identified optional cookie name/domain/path or web-storage origin/type/key; do not clear essential cookies or the saved refusal. Review browser and corresponding server-side collection settings, validate in staging, publish the approved changes and clear caches.
04Re-test: In a fresh session confirm Reject, record confirmation separately from the click, then inspect new request chains and writes for the configured observation target in your test setup, covering at least the measured window in Appendix A and later callbacks. Reload and navigate without submitting forms. The saved refusal must remain in force without newly initiated consent-dependent collection. Compare with a separate confirmed Accept session and retain sanitized results.

Accept	OptanonConsent	0.01036326

Reject	OptanonConsent	0.01041248

Collection-notice matching

Matches compare observed fields or activity with retained notice text and its association. Notice timing and legal adequacy remain unassessed.

Demo service enquiry: Wording not located

Form category, purpose wording and local notice association are assessed separately. Search input does not establish submitted personal information.

Category: not observed · Purpose: not observed · Association: not verified

Observed cookies: Partial wording retained

MUID: purpose unresolved; MR: purpose unresolved; tst: purpose unresolved; _ga_TEST1: purpose unresolved; _fbp: purpose unresolved; _clck: purpose unresolved; OptanonConsent: purpose unresolved. Notice purpose coverage requires every observed cookie purpose to be resolved and matched.

Category: wording retained · Purpose: unresolved · Association: page policy link

Personal data and purposes of processing We process cookie identifiers, browser and device attributes, page-view events, consent-choice events, and network-request metadata to validate analytics, advertising, session-replay and fingerprinting detection.

Observed browser storage: Partial wording retained

certscore_test1_consent_state: purpose unresolved. Source data is identified separately from its business use and notice wording.

Category: wording retained · Purpose: unresolved · Association: page policy link

The demo enquiry displays name, email, phone, postal code and message fields; its values are not submitted, read by the test runtime, or written to browser storage.

Cookie/storage purpose evidence

MR · cookie

Purpose: Unresolved